The payment is done via ajax over https - should probably make that more clear on the site