I'm running nodered in bluemix and am putting that system in production.
In my cloudant storage (the "nodered" db) I see 2 credentials:
in APPNAME/credential: {"credentials":{"$":"XXXXX"}}
in APPNAME/settings: { "settings":{"_credentialSecret":"AAAAAA" }
I I understood correctly, these credentials are for authenticating the user accessing the UI.
APPNAME/credential contains any node credentials configured in your flow.
APPNAME/settings is the runtime settings document. That includes _credentialSecret which is the automatically generated key used to encrypt the credentials stored in APPNAME/credential.
Neither of them are related to securing access to the UI.