Also, for those pesky secured sites that have unsecured static assets on a separate server, it might be that those servers aren't configured for SSL.