I was looking at the createdb.sql script in the distribution and wondered if it is really the best we can do.

It is a really unsecured default installation, and while I know any decent implementers would change it, I just wondered if we shouldn't be modifying it to be a little more security conscious.

I was thinking more like:
 

#
# Script to create the openvpms database, and add a single user 'openvpms',
# with all privileges
#

CREATE DATABASE `openvpms` /*!40100 DEFAULT CHARACTER SET utf8 */;

GRANT INSERT, SELECT, DROP, CREATE, LOCK TABLES, EXECUTE, UPDATE, INDEX ON openvpms.* TO 'openvpms'@'localhost' IDENTIFIED BY 'openvpms';

#  UN-COMMENT IF YOU THE TOMCAT AND MYSQL INSTALLTION ARE ON REMOTE MACHINES.
#
# GRANT INSERT, SELECT, DROP, CREATE, LOCK TABLES, EXECUTE, UPDATE, INDEX ON openvpms.#     * TO 'openvpms'@'%' IDENTIFIED BY 'openvpms';

We should also advise  that the user change the mysql root password to something personal and secure.