oops, thanks...had the 'encrypt all sites' setting to ON in https everywhere.