The SimplePush token is an URI. while we strongly recommend https, it is in theory possible that users of the AeroGear SimplePush Server do not protect the "update" endpoint via SSL.