You should really consider using SSL for at least the sign-up and login pages. People are transferring personal data, after all.