Also, you could use an extension to generate the signature. The password, in this case, would never be passed to the client.