Or apparently it *does* run over https, but with a cert for the mercurius subdomain, and nginx doesn't route it.   At least the login page should be running over HTTPS imo.   (Personally I don't really care that much because password manager, but others might not be using one)