Just as a reminder, this was standard before SSL/TLS. Every webpage was http-only.