I worked out a solution on solving exactly this problem in a browser setting using Javascript. Before you jump on man-in-the-middle, DNS spoofing, code injection or cross domain security, please take a look at http://www.research.rutgers.edu/~ashwink/ajaxcrypt/ and let me know if you have any comments!