[coderzach]

yes they can. They make the secure login connection, and terminate it themselves, then route what they received along to the user with s/https/http.