The web interface is the only admin interface. If you use the app to access it, all you're doing is wrapping the webpage inside the app. As far as I can can see (using the latest iOS build; perhaps this is different on Android), it's just HTTP there, too. If you use Remote Admin and are accessing your hub (e.g., from outside your network) that way, then you would get HTTPS, as all of Hubitat's cloud connections through their own servers use. The hub is capable of serving either locally, as was pondered above.
In other words, for this purpose, you might as well just use the website. 
You can upload your own SSL certificate if you want, too, though the feature is a bit hidden (and I don't need to say that it would be hard to revert if something gets messed up, but that possibility exists, too): Use my own SSL cert on Hubitat? - #38 by gopher.ny. I'm not sure what people who use this option do: use the default hubitat.local hostname, or run everything through a reverse proxy that only does HTTPS? When I'm on my own network, this isn't a priority for me, and if I'm not, I'm VPNed in anyway, so I haven't tried...
