at connect time
xmlBlaster say :
   TRACE XmlRpc.AuthenticateImpl]
   Stripped CDATA tags surrounding security credentials,
   XML-RPC does not like it (Helma does not escape ']]>').
   This shouldn't be a problem as long as your credentials doesn't
contain '<'
when connect qos xml is :
<qos>
<securityService type="htpasswd" version="1.0">
  <user>guest</user>
  <passwd>secret</passwd>
</securityService>
</qos>
or
<qos>
<securityService type="htpasswd" version="1.0">
  <user><![CDATA[guest]]></user>
  <passwd><![CDATA[secret]]></passwd>
</securityService>
</qos>
I know it's not xmlBlaster specific,
but I think here some one know the reason ;o)