No forced TLS, and when I manually enter https most of the resources try to load over http. c'mon, you've done the hard part of getting TLS, now you just need to make your home page aware.

EDIT: when I sign up it POSTs my password IN THE CLEAR. what year are we in?