{tech}.Ben Buckman.net

Drupal's Secure Pages module is great for enforcing HTTPs/SSL on particular parts of a site. But it's known to have a problem with Ajax, especially (for my purposes) autocomplete fields in node forms. The solution is to toggle https:// in $base_url so it's not seen as cross-domain, and that's most easily done by putting this line in settings.php (changing mysite.com as needed):

$base_url = ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS']=='on') ? 'https://' : 'http://') . 'mysite.com';