The simplest solution of all is probably to use HTTPS for _ALL_ connections, whether to widgets or to your site. The cost (in encryption overhead) is trivial* a

The simplest solution of all is probably to use HTTPS for _ALL_ connections, whether to widgets or to your site. The cost (in encryption overhead) is trivial* and the value is never having to worry about things like this. * - unless it prevents you from using a CDN to distribute images and other static-but-large content. Which it shouldn't, if you do it right.