It seems this is the functional equivalent of shouting your user name and password through a bullhorn at a hacker's convention. Total Google Security Fail. All android users, beware!
Google says they've fixed the problem over on the server side. No more unencrypted tokens should be floating about anymore...