Why do BaseReq is required for POST request? & How to use 'generate-only' parameter?

I am following the name-service tutorial.

The rest server request is embedded withBaseReq. I was wondering is it okay to send plain text password via an API to do sign the message on the node before broadcasting it to Blockchain.

Should the signing process occur on the client application side?

============================

I try to pass ‘generate-only’: ‘true’ parameter with BaseReq, but still, don’t understand whether we have to sign it after that or it doesn’t need to be signed and ready to be executed after broadcasting.

Is there any example of interacting with cosmos-sdk (GO) application via REST API using the ‘generate-only’ parameter?