Maybe the vendor improved since then (it's still not very secure as others and Chrome pointed out), but I remembered that back last Aug I searched for "https" in the source code and that's not the case.