I guess it is as I see the same thing. Indeed, one should use https but my initial test was on a test-server on my Lan behind an openwrt firewall/router. Have yet to enable ssl on apache2.