> We've implemented https so you don't have to I'm confused. Surely there is still a token or something for the authenticated session used on the original site

> We've implemented https so you don't have to I'm confused. Surely there is still a token or something for the authenticated session used on the original site. Wouldn't this leave the user's session open to hijacking if they didn't implement https on their site too? I understand this may be less of a concern for some applications, but it seems bad practice to spread the idea that https is only important for an actual login step.