[Scott]

Obvious, yes, the whole backend should be secure.

But you need to check current linkage. You don't want to cause any flags if you make the whole thing secure and have everyone linking to the http version.