You have no SSL. I are currently sending users passwords via plain-text.  You should take your site down until you can sort that out because you are putting your users security at risk.