Agreed - this was a side project developed almost 2 years ago. as someone else mentioned - entire app subdomain is under https. Only the marketing page is http.