Yes, always nice to see security consultants run http-only websites.

If they don't show they have the basic know-how on how to set up a ssl cert, I don't want them touching auth.