I suppose it comes down to human psychology. People are more used to entering CC info on a secure site (https padlock icon all that) rather than their desktop apps. Maybe the easiest solution would be to send users to a secure URL?