CVS server access

[John Smith]

Hello:

I recently configured my CVS server (Fedora Core 4) with ssh access
using public/private keys and with password authentication disabled.

I am able to access the server in one of two ways:

(1) ssh access

CVSROOT=:ext:<username>@SessionFileName:CVSRootLocation
So, for every CVS command, there is a ssh authetication.

(2) pserver tunneled through ssh

CVSROOT=:pserver:<username>@localhost:CVSRootLocation
For this, I am transfering the pserver port to my local machine using the
method described here
http://www.se.rit.edu/se-pserver-over-ssh-howto/pserver-ssh-howto.html
So, there is only one ssh authentication and pserver is tunneled through 
ssh.
My cvspserver service uses system authentication (so, I do not have a
password file in cvsroot).

Question: is there an overwhelming reason to use one over the other?

My thoughts are that (1) is more secure but more resource intensive (on the
server). With (2) I am running the risk of sending a clear text password
through the tunnel (is that correct?).

Your opinion?

Thanks.