[whpalmer4]

Credentials are stored in the keychain, and the traffic is encrypted thanks to SSL so long as the URL specified https: (does by default).