Use HTTPS instead of HTTP. Required when sending a credential, unless the host is a loopback address, where nothing leaves the machine.