Currently for the XML-API the user interface password and the xml-api password are different. Due to confusion I'll go ahead and switch it so that if the user is allowed to use the xml-api then they can authenticate against the XML-API acl using their interface password. This is a desire, not sure if this is possible in the current incarnation without doing a two-way hash on the URL passed in the handshake or starting to store user passwords in a two-way hashable fashion... :(
The ampache clients would have to be able to produce a sha2 of the users password