Yeah, I think we are. In WP, it's discoverable like that. However, the kind of non-discoverability you're talking about might also be a good idea.

Although, why would there need to be a username? What I'm thinking is of just a password, without the username (as the password is not person-specific, but could be mailed to several people)