That's what I thought.

I really hope that they make sure and point this out in bold font in all the docs.

Right now I don't see a mention of it anywhere and if people start to use this without SSL on their checkout page, there's going to be big trouble.

Totally correct, and we need to re-iterate the SSL requirement in a few places. Thanks for pointing that out.

Can't you do some degree of enforcement--even a reminder--by checking the referer header? Might not want to rely on it by refusing to process if it's not there, but perhaps making another hoop to jump through to try to make it easier to do it the right way. Like, a different API call for backend transactions that doesn't require a referer.

You still have the odd user cloaking it, though.