(note: not the author) At first glance, without going so far as to create an account, they do a lot of stuff right. I note that the HTTP session cookies set p

(note: not the author) At first glance, without going so far as to create an account, they do a lot of stuff right. I note that the HTTP session cookies set pre-authentication are not 'secure'. I.e., they can be be sent in-the-clear for HTTP connections as well. This may or may not be a real problem in practice.