I am not very familiar with PHP but in ASP once you are in secure mode (by specifying https://...) you will stay in secure mode as long as you do not go to a link that starts with http://....

I just tested this in ASP on a 2K3 box with IIS6.