make sure your login and signup are via HTTPS before you go much further.