Yeah, you need to remove the password so that the transaction history in app.json becomes readable.

Theoretically, it should be a relatively simple task to import that json into a script and get it to output the transaction history into a .csv format of your choice. However, one of the potential issues I see is that for transactions with multiple recipients, there is no indication which address is actually yours, but it does give the amount actually received (as opposed to full transaction amount), so I'm not sure how big of an issue that really is.

Still, a simple "export to csv" feature would be easier for everyone...