IIRC, I recommended that SSL get added to the chip tool and add a simple htaccess redirect to force https but there was some issue with loosing the saved mockups that casino customers had who were actively using the tool. Not sure if that is still an issue now (or the only issue at the time), but I do agree that SSL access is the way to go especially with the login info.