Turns out this was an issue with Chrome & Firefox > v52. Neither will honor 'secure' flag from non-https sites. I tested my scenario with Midori and it did honor the flag, so the module was working as it should.
↧