Comment by ssalazar

HTTPS is critical yes. If hash(password) is sent over HTTP in plaintext, then hash(password) can just be used in a replay attack.

You shouldn't be sending passwords in any form over unencrypted HTTP, and there isnt a clear case for hashing or obscuring the password over HTTPS.