Ok to send password in clear text over unencrypted connection?  Should this be over https instead?