I wish protocols like TLS-SRP (or SRP as an HTTP auth method?) would become more prevalent. At that point you can authenticate over a clear-text stream and it'd be secure. I don't see any reason we should still be sending secret information to a server like this.