In any of the 'get started mining' type sites, I see that password is always x. In xmr-stak, it seems to suggest putting in 'mostly empty or x' as a password. Does this really mean I should be using some default one-character password, or am I just misreading?
The 'x' is just a placeholder. It is up to the pool to decide how to use it. It is just an optional message that could be passed between a miner and a pool. For example, often pools allow miners to use it to assign individual workers names/IDs.
It's a placeholder, since they're unused (or, at least, I am not aware of any mining software which uses that password), even though they're part of the JSON communication between miner and pool. You can put whatever you like, x or otherwise.
They're used to login to the pool's UI, usually if it's an email address the pool will also email you alerts regarding the status of the worker.