I was about to say the same thing. You must differentiate `/login` used for classical form login that should be reachable without `https`, and `/login/whatever_amazon` that needs `https`