No - parent mentioned SSL - originally people were claiming it was sent as a clear text POST - the part that people failed to recognize was that it was over SSL and that is what was debunked later on.