This is incorrect. https encrypts everything.