I think gmail is purposefully making http/https both work. I seriously doubt there is a browser issue. Login cookies for ourdoings.com are secure-only, and AF

I think gmail is purposefully making http/https both work. I seriously doubt there is a browser issue. Login cookies for ourdoings.com are secure-only, and AFAICT no browsers fail to handle them correctly. And you're right, this is not an issue limited to AJAX.