I run a DotNetNuke e-commerce site (4.8.3) and our web application vulnerability scanner is picking up a page where users can enter a password and have it sent clear text.  Obviously, this isn't desierable, so when I checked the URL of the page, it's picking up /tabid/[x]/ctl/Register/Default.aspx, which really doesn't require SSL.  Since the /ctl/Register portion of the URL is what's bringing up the registration page, I cannot enable SSL for it since the control could load on any page and only a few require SSL for our site.

So as a solution I wanted to setup a friendly URL filter to redirect any requests for the Register control to my registration page which is encrypted.  However, the friendly URL module doesn't seem to be working for my matches, maybe because the /ctl/ parameter is built into the core?  I'm not really sure but I could use some help!  I've tried to setup this match and several variations with no luck.  Can anybody help me?

.*/TabId/(\d+)ctl/Register(.*)/Default.aspx -> ~/Default.aspx?TabId=[x]

I understand that the module will not perform a redirect.  However, I thought that it would perform a HTTPContext.RewritePath() so that instead of bringing up the unencrypted /ctl/Register/ page, DNN would use my encrypted login page.  This is what I thought would happen:

1. User makes request to /ctl/Register/Default.aspx
2. URLRewrite module would perform a HTTPContext.RewritePath() so that any processing sees the current page as being the encrypted one.
3. Seeing as how the login page is secured, the framework should now perform a redirect to the https:// version of the page.
4. Now the user is at the correct URL with the login form displayed.

Is it possible to set this up?  I don't want users to be able to login using http://