Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game).
Users can download new questions from a server's API. Next, the users can upload new questions they made up to contribute to a common database of questions.
I was pretty much always taught to use a HTTPS on production servers. However: do I really need to use HTTPS with some kind of security token in this case? Is there a way to inject some malicious questions if simple HTTP is used? Or other threats?