>I have not seen him mentioning that the web service is apparently invoked over unsecure http.

It's mentioned. From the blog post: "besides the ugliest formatting ever and the fact the request uses plain HTTP"