There are ways to improve security via encrypting the password clientside with a nonce and avoiding passing raw text over the request to the server (which should be https not http) but I believe it isn't considered necessary above the inherent security in most circumstances.