Yeah, it's from the old days where HTTPS was avoided for speed, just used where needed. Nowadays the push is for everything to be HTTPS. We'll do that eventually, just lagging behind a bit. A number of users are inside the great firewall of China and it may be easier for them to establish non-HTTPS connections. At least, what we have isn't currently broken, so we haven't had the need to change it yet. 🙂
