But isn't it bad practice to send plain text passwords to the backend? Shouldn't you encrypt them in the client already?