1) Curl asks for the password on command line (stdin) if &lt;user&gt; is used only. And it's more secure as the password is not visible in "ps" output. (But yes the escaping is missing there.)

2) yes, https should be there. *hostname* is probably better than *localhost* (more generic), but it's used in other modules as well we should fix it everywhere...

3) I'd completely avoid using -k in the examples. It's true that we actually need it (because of the self signed certificate) but it's not a correct solution. You should copy the SSL public key from the server and use "--cacert [certfile]" curl option.
  And using -k with a real (signed by a CA) certificate must be avoided as it makes the connection insecure.