Yeah... this is actually a surprising (at least to me; certainly irritating) liability of allowing users to access your website via https..