The whole site should be https and never load assets that are not -- from the start. Especially since it's an investing site with access to sensitive information.

It should really redirect automatically and not rely on you getting the "https" part of the URL right manually.