If you access the app using https-ed Facebook, i.e. via https://apps.facebook.com/appname https://apps.facebook.com/appname, it would use https:// https:// for

If you access the app using https-ed Facebook, i.e. via https://apps.facebook.com/appname https://apps.facebook.com/appname, it would use https:// https:// for the iframe as well. So, no problems there (at least no new ones that did not already exist).