[prodigal_erik]

For the sake of your users' privacy and security, use TLS (or IPSec) and a certificate that identifies your server. Anything sent in the clear is vulnerable to eavesdropping and tampering, whether or not the destination IPv4 address appears to be under your control.

[eli]

That's not always practical if you're interacting with another service like Facebook that won't know to check.