The login url contains the string redirect_uri%3Dhttp%253A%252F%252Fwww.realworldocaml.org Looks to me like whatever Github authorizing is being sent back

The login url contains the string redirect_uri%3Dhttp%253A%252F%252Fwww.realworldocaml.org Looks to me like whatever Github authorizing is being sent back to an insecure non-https site. If a passive observer were to see this in transit, I think they could probably steal the authorization token a la Firesheep. The FAQ says "you temporarily grant us access to your public repositories", so I'm thinking this probably means your Github repos become writable to an attacker.