The authorization cookie has neither the secure flag or http flag set.<p>i.e. If you could get the client to redirect to <a href="http://paste.sh" rel="nofollow">http://paste.sh</a> it would send the full auth cookie in the (now unencrypted) headers. (Man-in-the-middle can then use the cookie.)<p>Edit: For anyone checking, the cookie is only set upon the first edit.
See also: <a href="http://www.matasano.com/articles/javascript-cryptography/" rel="nofollow">http://www.matasano.com/articles/javascript-cryptography/</a>