Hi,
the only problem is that you're sending out credentials without need, even to a (potentially) forged host.
That's ok if know who you're talking to . If you have high security requirements, you should verify the SSL certificate identifying the HTTPS server - in this case you probably already use https. See Crypt::SSLeay or IO::Socket::SSL on how to do that.
Martin