Looks like your password gets hashed in JavaScript before it leaves your browser. That's not much better then sending both in the clear though.
It would be easier for an attacker to just steal your cookie after you sign in since there's likely no encryption for that either.
And then that's assuming someone would want to impersonate you here.