...and the reason that those APIs require SSL is so you can't access them via man-in-the-middle attacks of other websites that you have authorized access to those APIs for. The attack here is that I can use those APIs on your computer if you try to access this service, as I can forge the insecure DNS responses to get you to connect to my instead of localhost and then forge the SSL verification to make the hostname valid. I don't even need you to try to use the service as I can hijack an existing HTTP connection you make and give you an iframe or a redirect. If I access those APIs, I am then working off of Cisco's authorizations; if they have used any of these APIs and the user authorized them I control them, and if the user hasn't they will be asked to authorize Cisco, not me, which might seem legitimate.