Great catch. This should be over https. I will fix it.