Throw in ssl and that fixes that problem.
An interesting example of this is glbse.com, it's a bitcoin stock exchange, on the site there is a client python library and a JavaScript client application (to run in the browser).
Putting aside how poorly documented (and designed) the JS client is, what they use it for is authentication/authorisation not... for actually encrypting.
All requests from the JS client are signed with a RSA private key, the server keeps a copy of the public key, and verifies any incoming requests.
The private keys can be stored in html5 local storage (encrypted if you want).
The keypairs are initially generated on the server.
When they first started making this available it was being served over plain text http, now they use SSL for the reasons above.
The idea is to remove the need for servers to store username/password combinations. The users account ID is a sha256 hash of their public key.
https://glbse.com and the JS client https://glbse.com/client/glbse/ as I'd said the UI on this is terrible, but it's something they're working on.