I am well aware of that. This however wasn't a major problem in our use case:
- we do not have anyone on our network that is capable of sniffing (stuff on Heroku are sandboxed, and afaik, they claim you cannot dump things out).
- in most deployments, it will sit in a private network of somekind (EC2 server clusters)

The only real issue is with the lack of https for *client* machines (direct HTTP and WS). It's something I've been meaning to add :)