uh-oh
had to do a password reset now... system sent new login details (username and password) in email without even trying transport encryption