Comment by exec

Not using HTTPS is a critical mistake. Adversary can just do MITM attack and send modified code to the user's browser to steal passwords.

It's not best idea to share sensitive documents without using HTTPS.