Commander is meant to be run locally and is only exposed to the web at the user's discretion. We always recommend securing your wallet and web app with SSL, but for the purposes of this demo, left it open so as to let users send money without an encryption key. As for SSL and PLAINTEXT -- we're literally giving out the username and password, in plaintext, in many locations. I would imagine it much easier for someone to find it there than sniffing packets.
"But how will they integrate any kind of anonymity feature with this web wallet if the operator has access to private keys and may even know who you are (for example, it may store your IP address)"
USER = OPERATOR
YOU are the operator.
I think that many people (obviously wrongly) assume that this will be hosted online service. Maybe you need to update your announcement.