We currently have ELBs which terminate the https connection and decrypt it for the node servers themselves. We do however force https, so I think it is worth a comment that we do only only https connections for the real environment and hence it isn't an issue here.