I would suggest forcing the SSL across the board. I know, I know, I can type it in BUT it is just nice to have the little things work all on their own, even when I am logging in.