Admin.sites.url password transmission
It is sent in the clear, then the server hashes it. You would need to use https to prevent eavesdropping.
When you login to django, does the password get hashed and then transmitted or is it transmitted in the clear and the server does the hashing? 
This is within the context of not using https.