It seems this problem can occur in several places within the plugin... but this particular section was causing problems:
// login form
if (force_ssl_login() || force_ssl_admin() || is_ssl())
$sidebarlogin_post_url = str_replace('http://','https://',sidebar_login_current_url());
else
$sidebarlogin_post_url = sidebar_login_current_url();
Note, I have added the extra 'is_ssl()' in the above to fix the issue.