You should be encrypting the traffic by default for all users especially the free ones. You need to make sure the HTML you send is the one that gets delivered....