Currently, if you want to use a Jira RSS feed in an RSS aggregator, you have to copy the URL and manually add os_username=pol&os_password=pot. This is a bit of a PITA. Most users dont know this os_incantation. Also, for the {jiraissues} macro in Confluence, you are forced to put the username/password in clear text. What I would like to see is something like Fisheye's RSS support. Fisheye generates a url with a security token - which can be used for that URL only. The security tokens are stored against a user - so its possible for a user to nuke all their pre-authenticated tokens.