It seems the API does not allow to set the image password:

param :name, String, :required => true
          param :username, String, :required => true
          param :uuid, String, :required => true
          param :compute_resource_id, String, :desc => N_("ID of compute resource")
          param :architecture_id, String, :desc => N_("ID of architecture")
          param :operatingsystem_id, String, :desc => N_("ID of operating system")
          param :user_data, :bool, :desc => N_("Whether or not the image supports user data"), :allow_nil => true

Is this an intentional omission (maybe due to sensitive data)? Otherwise I can cook up a patch.