So all we need to do is mitm your session and replay the encrypted blobs.

Maybe I should revisit my decision to not become an API reseller...