I installed Secure Pages on a site, where I need to secure admin and user login pages. In general, it does its job, but when the user first tries to log in, and goes to the /user page, that page is not redirected to the secure page. The form action attribute is rewritten to the corresponding https link though.
Do you have any ideas why this could be happening?
In Secure Pages config, I use 'Make secure only the listed pages' option, and tried 'user', 'user*', and 'user/*'. Base urls are blank, but I tried filling them in. There are entries in 'ignore pages', but I tried removing them.
Another thing I noticed is that it works when the user is logged in. Could be a permission issue, but I did not see any relevant permission.