I\'m working on a project where I need the following.
Short answer; you can't. As soon as you use username/password you need some sort of secure channel.
However you don't need certificates on the clients; only on the server.