Yes, Looks like they are not using https all the way.