I've given some thought to that - it uses the same mechanisms as jsfiddle (different domains) and you can view the haxx code. As such CSRF should be fine and SSL isn't supported on public haxxlies.

I however, wouldn't recommend signing in through the service :)