I think it was related to the "with or without SSL". Obviously the data you send can be intercepted without SSL but no other data (and with SSL not even that).