Crucially, the login form itself isn't included in the high-volume (http) landing pages, but is isolated behind a (https) link from those pages.