Thankyou for the feedback! I have rechecked the task and now see that I AM supposed to use TLS to encrypt the ENTIRE HTTP Request message.

I am running on an apache HTTPD Server, so maybe I will use mod_ssl.

Cheers.