This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user l

This is a very good point, but as you say and the article states, the lack of warnings for this is changing. There's also the obvious question of having user login/signup on a non-HTTPS site in the first place (pseudo-anonymous user accounts or otherwise).