The reply from Facebook:

"Hi Stevie,

This issue has been reported some already so unfortunately cannot reward you, instagram is working to get https for all endpoints. Its a pretty high barrier to exploitation to already sniffing someones traffic however.

Thanks,

name removed

Security

Facebook"

And here I am sitting in the Apple Store around the corner from my apartment watching various cookies whizz past my screen.

I don't agree the barrier to exploit is high. All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it. At that point Pandora's Box has been blown apart. The obvious precedent for this is Firesheep (now sadly not functional) from back in 2010.