[dustinrodrigues]

Probably shouldn't just be using HTTP for a password change.

[StavrosK]

HTTP is the protocol, all HTTP needs to go over TLS anyway.