Simply configure your web server to use SSL.
I wasn't going to suggest that, however you are very correct. Reason I wasn't going to suggest that is depending on his web environment it may not be an option. For instance hosting companies usually (well... that is less true these days) charge a premium for SSL enabled hosting. In a corporate environment SSL usually incurs a cost that some management won't approve.
Peter L. Berghold -- Unix Professional
Peter -at- Berghold -dot- Net; AOL IM redcowdawg Yahoo IM: blue_cowdawg