Login security via SSL/HTTPS

[FFX01]

Though not an issue during development, it will be very important in the future that we use SSL/HTTPS to encrypt post requests for user login and registration as otherwise, user password data is sent via POST request as plain text in the form data in the request header.

The passwords in the db are hashed and secure, so the server doesn't know what the user passwords are, however anyone sniffing packets over a wifi network or man in the middle connection will be able to gain access to the user's password in plain text format. This is not good.

In short, when the site goes into production, we MUST use SSL/HTTPS.

[Master-Foo]

I'll be sure to have an ssl cert. It's pretty much standard procedure to generate one.