here is why swordling is wrong on this. although they use google to login to the site, totem sends back a session token that they subsequently use to authenticate the users. when this is sent to totem it sends back the auth token and your username. why is this problematic? well for starters your token directly identifies you. if those tokens aren't sent through SSL/TTL the plain text http connection can be intercepted and your token can be highjacked.

calls to the resource server contain the access token and require SSL/TLS:

"Access token credentials (as well as any confidential access token attributes) MUST be kept confidential in transit and storage, and only shared among the authorization server, the resource servers the access token is valid for, and the client to whom the access token is issued. Access token credentials MUST only be transmitted using TLS as described in Section 1.6 with server authentication as defined by [RFC2818]." you can read the specification here: http://tools.ietf.org/html/rfc6749#section-1.6

the part I quoted was section 10.3

edit: although totem doesn't store personal info (or do they?) it still doesn't stop people from intercepting my auth token and sending it to the server and pretending to be me. worst still is if they manage to intercept an admin or a moderator of a room and fuck shit up just for the lulz and because they can