It's open source, you could always donate some of your own time to do it properly...

As jbyers said, it should be trivial to stick a webserver which supports SSL in front of the app. Perhaps it would be a good idea to modify the app to add the secure flag to the cookie it sets though.

Why do you care? I've already used Firesheep three times to downvote using your account.

I'll do it with this comment, too.

I only care about your session. You can keep your password, unless I brute-force it from a 37signals webapp.

Ah, so you do care enough to not share your password. So I guess the reason I care about SSL is the same reason you care about SSL.