@icedquinn I wrote something similar (http://swiley.net/dcgui.html) a long time ago that used data: urls instead (that way you can worry less about the server being compromised, and it also works with static hosts like github pages or busybox httpd.)
It used RC4 instead though so it's really not much of an improvement over plain text.