Uh yeah, welcome to http.  If you read the warning that pops up when you submit a form over http, it says exactly what the author "discovered".  If he disabled it without reading it, that's his fault, not Tumblr's.<p>But of course, I think everyone should use https.  I hear the excuse, "it uses too much CPU time", but this is often from people who have written their web applications in <i>Ruby</i>.  Not using https is a very premature optimization, in that case.  (Of course, crypto is not that slow on modern computers.  I can do about 60Mb/s of AES on one core of my 8-way consumer-grade machine.  If you are getting a constant 480Mb/s of login form submissions, you can probably afford one of those load-balancers that does SSL....)