[stevenhuang]

you're still not getting it

it doesn't matter what content is being served

the point is if your site is on HTTP a third party may silently inject malicious code into the response.

any visitor that views your site now becomes subject to this threat vector.

you may argue nothing will come of it, sure, but then you should make that your argument.