How is the password sent across for verification?
It depends on the particular scheme. In a simple challenge-response scheme, the server sends a challenge, the client "encrypts" the challenge and the password to form a response, and then the client sends the response over the wire.

However, standard logins typically don't use challenge/response. The password is just sent to the server by the client. When using SSL/HTTPs, the password is protected by the encryption of the channel. When using ordinary HTTP, there's no protection whatsoever. With no security on the channel itself, even with a challenge/response protocol, an attacker can simply proxy the authentication portion of the protocol between the client and server and then takeover the authenticated connection after that phase completes.