You must use HTTPS.