I'm using Sidebar Login plugin (which works great, by the way). I set the FORCE_SSL_LOGIN variable according to the directions here:
http://codex.wordpress.org/Administration_Over_SSL
and noticed that wp-login.php (Wordpress' built-in login) was using SSL, but the sidebar login plugin wasn't. Here’s what I had to do to fix it:
In the wp_sidebarlogin_current_url function, right before the last line (return $pageURL:, line 389 in version 2.2.4), I added these 3 lines:
if ( force_ssl_login() || force_ssl_admin() ) {
$pageURL = str_replace( 'http://', 'https://', get_option('siteurl') );
}
And that did the trick. Hopefully this can help someone else.