It's the GET params (i.e. the ? and everything following it).
I think this is a good move. Turning https on is a case of sensible defaults. Users generally won't think about data security and others being able to intercept their HTTP traffic.
I do wonder if there are any numbers comparing performance with http with https. Should be too hard to measure.
Note that this causes some mail readers (like Google's gmail notification program) to stop working. It's possible that this has been fixed since I last tried it or there is a workaround, but just thought I'd mention it.