HTTPS server

[QuinnBast]

There are no options to configure the server to run via HTTS using TLS right now and the user's usernames and passwords are being sent in plaintext over the wire which is a huge security flaw.

You should enable TLS support on the server.

[neozmmv]

Thank you for pointing this out.
The recommended deployment for this project is to terminate TLS at a reverse proxy (e.g., Nginx Proxy Manager, Nginx/Traefik/Caddy) and expose the app only behind it, with HTTP→HTTPS redirects, HSTS, and secure cookies.
For local development, I'll work to add documented support to run over HTTPS as well (self-signed via mkcert or something like that).
Thank you again for flagging this!