What's the point of even using HTTPS if the content in question (and worth protecting) is served via HTTP. The way the support person misunderstands repeatedly and then plays it off as "That's what I meant, duh, we don't care" is pretty tacky.

"Oh, I'm sorry, I misunderstood." changes the entire tone of the post. It's not like this is even hard to fix.