That's what he means by "forcing it" - if you specifically type https://mail.google.com/ https://mail.google.com/ Gmail will encrypt the entire session; if you

That's what he means by "forcing it" - if you specifically type https://mail.google.com/ https://mail.google.com/ Gmail will encrypt the entire session; if you just go to http://mail.google.com/ http://mail.google.com/ or (more commonly) www.gmail.com it uses SSL for authentication, then switches you back to unencrypted HTTP for the rest of your session.