I suspect the opposite would be true. Non-power users are more likely to be fooled by the (arbitrarily-chosen by attackers) URL path-info. This focuses relative

I suspect the opposite would be true. Non-power users are more likely to be fooled by the (arbitrarily-chosen by attackers) URL path-info. This focuses relatively more attention on the domain and secure-indicator.