The web page must be served from somewhere, even if the server it came from really wasn't involved in file transfers. It would be nice to have HTTPS for the client to rule out MITM attacks or the like.