Look, I'm not saying it's not concerning. I'm saying this does not imply anything on the design of the application. If the only lesson I can get from this is "to use SSL", then the design lesson wasn't very illuminating. Get it?