Yeah, I was going to ask the user for confirmation before falling back to HTTP, when I realized what you did: an active attacker can just change the URL of the

Yeah, I was going to ask the user for confirmation before falling back to HTTP, when I realized what you did: an active attacker can just change the URL of the iframe. Anyone who really needs secure pokemon battles can just use the HTTPS site, anyway. (Which does ask the user for confirmation before falling back to HTTP, if an HTTPS connection fails)