Also: The pluggable auth patch suffers from the same issue: if everything is on HTTP, it's easy to steal the cookies if you're at the same network :)