If you use .onion address ignore lack of https. The traffic within Tor is encrypted. Check twice everything what this girl writes.