This maybe my own rule of thumb but i believe that companies that serves sensetive forms over http also save the password in plain text.

They should be a shamed.