Many sites avoid going all https because of the - sometimes alleged, sometimes real - performance loss.