I think it's supposed to be approximate shorthand for "All logins should be run over SSL only, but if you must forgo SSL, then definitely don't use this login handler because you will be especially vulnerable, as the dumbest, most passive of attackers will see the password in plaintext going across the network."

I think we should either update the comment to say something like that, or just delete it entirely, since the distinction between this and other login handlers is even blurrier now.