It's kinda weird to do HTTPS within a modal IFRAME. The padlock icon is an interesting hack but not enough IMO.