Is it safe to send a POST to a web method with a JSON string containing a clear text version of a password for authentication?

Who could sniff that password on the way from client to web method?

I saw some posts a while ago on "salting" a password - is that something you do in JS on the client side and then "unsalt" on the server?