^ this is being looked into but for now (as a troubleshooting sort of thing), ALWAYS make sure you're on https. It shouldn't happen on https. So every time you click on a link on site (even if you were on https before), check if you're STILL on https. Most browsers afaik TELL you if you're not on a https website; it'll say something like "not secure" next to the URL - at least Chrome and Safari do.