As far as I can tell, there are no unsecure items — when I browse to the site with IE7 or FireFox 3 I don’t get any such warning, but if I hit the site with IE6 I get the security informaiton dialog box “This page contains both secure and nonsecure items Do you want to display te nonsecure items?”
How can I track down the cause of that message?
As it turns out it has nothing to do with nonsecure traffic per se, but with a hack that one of the HTML boys did — they have an empty iframe (without a source) that they place on the page, so they can then do some placed content on top of that — gut the iframe out of the code and the warning dialog box went away. IE7/8 and FF doesn’t do it.
AFter adding a blank.gif we’re able to https to that gif (what a pain) and now it’s all good.