Scenario: Logged in to en.wp via secure server, just blocked an IP address.
The successful blocked page returns unsecure URLs (http://en.wikipedia.org/wiki/...) for several of the user info subpages for the just-blocked user.
The list reads: (talk * edit talk * message * contribs * block log * unblock * watch)
Of those, edit talk, message, block log, unblock, and watch all go to the unsecure en.wp URL. Only talk and contribs go to secure URLs.
I have not had time to look into the code and see what's going on.