We don't transfer any resources over HTTP on www.authy.com, we even use HSTS on www.authy.com.

Demo is over http because it's not meant to be a secure site, only something you use to see how it works. Database is destroyed daily, but I agree we should change it to https.