Wow, that is not only worrying, but I'm fairly sure it's breaking PCI compliance. I don't have an account so I can't check, but is it possible the payment form

Wow, that is not only worrying, but I'm fairly sure it's breaking PCI compliance. I don't have an account so I can't check, but is it possible the payment form is in an HTTPS iframe? If not what happens if you manually put https in the url?