REST API /streams/{streamId}/alarmcallbacks returns password as clear text

When you issue a GET request for an alarmcallback in a specific stream `http://172.17.0.42:12900/streams/55116235e4b020d47079443a/alarmcallbacks` and the configuration data in the alarmcallback contains a password, the password field is returned as clear text (see `CONFIG_AUTH_TOKEN` and password `mySecretToken`):

```
{
"alarmcallbacks": [
{
"creator_user_id": "admin",
"stream_id": "55116235e4b020d47079443a",
"configuration": {
"CONFIG_INCLUDE_FIELD_NAMES": true,
"CONFIG_MAX_PARTS": 0,
"CONFIG_AUTH_TOKEN": "mySecretToken",
"CONFIG_FIELDS": "",
"CONFIG_RECIPIENTS": "27999112345",
"CONFIG_MAX_LENGTH": 0,
"CONFIG_STATIC_TEXT": "",
"CONFIG_RESULT_DESCRIPTION": true,
"CONFIG_MAX_CREDITS": 0
},
"created_at": "2015-03-31T13:58:03.638Z",
"id": "551aa7ebe4b0167c42137595",
"type": "biz.dfch.j.graylog.plugin.alarm.dfchBizClickatellAlarm"
}
],
"total": 1
}
```

This issue relates to graylog2/graylog2-web-interface#1134 . The fix was obviously only done in web interface (but must be applied to the underlying REST service).