Query strings over HTTP are really easy to steal if you're on the same network. If you're using this now (without https) it's probably not offering you any real security.