[Sketch]

Thats my understanding of it funguru.

However you may want to put a redirection on the login.php to ensure that it always goes to the secure version.

Something like this will help;

if($_SERVER['ssl_access'] != 1 && $_SERVER['HTTPS'] != on) {
	header("Location: https://www.yourdomain.com/login.php");
	exit();	
}