Yes, this is true. I'll mention this in an update. When working in dev I've always just used regular HTTP. I'll mention how to configure Rails to use SSL.