[nevinera]

It looks like the actual best answer is to use ssl - apparently most apps transmit their password in the clear, and just rely on ssl to keep it from being observed. I'll amend my post.

[brickcap]

Ah thanks for letting me know. I had opened an issue to change my implementation but I guess I will leave it now. Thanks once again.