Need to modify security

I got an email from Google saying that all chrome extensions need to meet some minimum security requirements. The extension I wrote in javascript runs in the context of the Chrome browser. Here is how the security currently works: an extension user is authenticated with oauth2. Once authenticated the extension uses the user's email account and sends this to my CI server (on https). This sending of PII is not encrypted and the response back from my server is not encrypted (other than https). I need to encrypt this communication to meet Google's requirement. So what type of encryption would be easiest to use both in CI3 and also in plain old javascript? Is there a CI library for this? Also, do I need to worry about encrypting the oauth request for a token?

Thanks, Rich

proof that an old dog can learn new tricks