Issue
During a login or signup, passwords are submitted in plaintext over the wire. This isn't uncommon practice: most major apps these days do so (e.g. Twitter, certainly others) since plaintext is not actually plaintext on an HTTPS connection. But Glam is intended to be easy to deploy even for people with limited technical skills, and HTTPS may not always be available.
Solutions
Require HTTPS. Undesirable because it's an imposition as noted above, and if users ignore the requirement, attackers would be able to get passwords.
Apply a cryptographic hash to the password before sending it. This comes with the minor disadvantage that password requirements will no longer be able to be enforced if client-side validation is bypassed (e.g. a user could make a 1 character long password), but this seems a small price to pay.
Issue During a login or signup, passwords are submitted in plaintext over the wire. This isn't uncommon practice: most major apps these days do so (e.g. Twitter, certainly others) since plaintext is not actually plaintext on an HTTPS connection. But Glam is intended to be easy to deploy even for people with limited technical skills, and HTTPS may not always be available.
Solutions