Never send a password again. The idea is to only send password hashes. The simple solution is to send a hash of password plus username. Wow so simple; never again do websites need your actual password.