They send credentials in plaintext over HTTP? Exciting. :-/