Interestingly the application page/subdomain is not HTTPS, but the main site is.