Thanks for the heads up Charles, We'll try to get on top of it...
It could be related to the move to https. We won't be fully https until SMF releases the next update.
Photos and avatars pulled from off site storage are not encrypted at the moment but passwords and messages are.