The feedback I have received so far has been to take the service security information out of the user-profiles file and have it only be a description of the profile structure. So I will do that but also will provide automated migration when starting a new version of Geonetwork on an old system.
Speak now if you oppose this decision or want more clarification.
Jesse