Since you want to avoid SSL, try this.
Store the passwords in the db MD5 encrypted. Use a piece
of JavaScript (shudder) like this one to MD5 the user's password BEFORE it is sent back to the server. I've not tested this JavaScript code, but it doesn't appear to contain any browser dependant things.