You should force SSL. Following the header links causes the page to reload over https.