The main page is http: but they have an embedded iframe that loads the login form from https: and submits via the same.

When they first did this it worried the fsck out of me. It breaks the "look for the gold key" UI of the browser for one. It was noticing that iframe loading slower than the rest of the page that first clued me in to what was going on.

I imagine they're doing it to keep the load on main page down for those not logging in.