[mmahemoff]

Plain http links? I suggest using TLS/SSL for any authentication platform. I know it's a quick hack, but you can quickly setup a secure proxy with Cloudflare.

[pauldino]

Actually you don't even need that, *.herokuapp.com comes with https for free.