Was hoping someone would say this. This should be the only thing they focus on this year until it's done. I see that they POST to a secure endpoint when logging in but that doesn't make a difference once the session cookies are transmitted in the clear.