It is good practice to at least encrypt the authentication process, so that someone can't grab plaintext passwords as they are transmitted.