Tell your friend to store only an encrypted version of the message on their server and add the encryption key to the message url as a hash. Decrypt it in the browser for the reader.

Sending unencrypted text over http isn't what I'd choose for my top secret messages.