Use SSL

[abkfenris]

Should have SSL configured.

Get a wildcard cert from somewhere like StartSSL - trusted on most desktops and mobiles, but not windows phone maybe?

Force ssl for /admin with something like:

server {
     location /admin {
        rewrite ^ https://$http_host$request_uri? permanent;
    }
}

server {
    listen 443;
    location /api/1.0/trail {
        rewrite ^ http://$http_host$request_uri? permanent;
    }
}

Which has it reverting back to http for trail api, and maybe other api calls so that proxies can cache them better?

Strong SSL Security on nginx

SSL in Postgres