I always understood that all SSL connections are encrypted including the sending/receiving of logins and passwords. It will be as secure as SSL.

Sorry, I didn't explain it too well. At present, the user does have a login (.htacess,etc), and he accesses it like this

http://example.com/userloginpath

which, as I understand, still sends the user/pwd across the 'net as plain text. What I would like to do is to _force_ it to be

https://example.com/userloginpath

.. although he doesn't have SSL, I do, so using mine on a shared basis

https://mydomain/example.com/userloginpath

Peter