PAWS is quite happy to let you access it over plain HTTP – in fact, your session remains valid across protocols, so you don’t even need to log in, your token will just silently remain valid after you sent it for all the world to see :/

Suggestion: redirect all HTTP requests to HTTPS with 301 Moved Permanently, send an HSTS header (e. g. Strict-Transport-Security: max-age=2592000, one month), and if possible invalidate any token that was sent over plain HTTP (e. g. if the max-age expired or the browser doesn’t support HSTS).