I'm trying a new experiment: I just turned on HTTPS Everywhere's "block all unencrypted requests" option. We'll see what breaks.