I have a wireless device that is not attached to the domain.  So I created a
Web Service that I pass the UserName and Password to see if it is a valid
user using the LogonUser API.  I have the WebService site set to use Anomyous
access.  This is all done on our Intranet.  I was thinking that I needed to
set it up to use SSL to encrypt the UserName and Password.  

I'm fairly new to security with Web Services and was wondering if this was
approiate way or if I should be doing this a different way?  What security
issues should I need to address seeing how this is on a local intranet and
also considering it is a wireless device?  I definitely do not want to be
sending UserName and Passwords as plain text over our wireless network.  Any
links or input is appreciated.

Thanks