You're right - we have some non-ssl'd pages that you're allowed to login from - something we've gotta fix.