The average user does not have JavaScript turned off. Plain http sites are a risk to their users.