Also, make sure you don't save the users passwords in plan text. Also, don't save them in a weak encryption with the key stored somewhere in your system.
If your server gets hacked and the passwords get released, your user will get very angry.

Instead, store and send only a (salted) hash of the passwords. Nearly every serious login systems use that.
Whenever a users logs in, he only transfers the hash of his password to the server which is compared to the hash saved there.