When handling the OAuth redirect, the application returns an auto-submitting HTML form that posts to an http:// endpoint:

<form action="http://faction.sld.com/oauth" name="f" method="post">
  <input type="hidden" name="username" value="john" />
  <input type="hidden" name="password" value="" />
  <input value="POST" type="submit" />
</form>
<script type="text/javascript">
  document.forms['f'].submit();
</script>

Because the form action uses http://, It could potentially leak JSESSIONID and other cookies. While modern browsers may automatically upgrade requests to HTTPS when Strict HTTPS-Only mode is enabled, the initial use of HTTP can still trigger warnings that undermine user trust and disrupt the OAuth flow.