Did they hide it? I see "https://" in my Firefox.
security.insecure_connection_icon.enabled
security.insecure_connection_icon.pbmode.enabled
Though it's still disabled by default (currently the insecure connection icon is only shown if a password field is present on a http page / the form action url is http).