I noticed this line in my mercurial.ini file (as it was set up by the installer):
[auth]
kiln.schemes=http https
Does this mean that, under some circumstances, the Kiln authentication client would consider authenticating in cleartext?
It probably doesn't, but just checking.