Noticed it allows me to browse the site insecurely and send my password from the unprotected login form.
Preference session protected enabled (Preference name: session_protected)
Permalink: https://copydoc.tiki.org/blogpost11-Protect-all-sessions-with-HTTPS-enabled