I didn't get that impression from the mailing list post. They were exploring ways of adding more security depending on context. That's a long way from "https on

I didn't get that impression from the mailing list post. They were exploring ways of adding more security depending on context. That's a long way from "https only feature". Perhaps the user just needs to acknowledge the switch (instead of just being notified of it)? Or set a browser flag to override?