API requests will be made over SSL if the window URL is SSL.  If no window object (PhoneGap), login and user methods will be SSL. [link]See more details on the JS SDK and SSL [/link].