@Security, tapestry.secure-enabled, MetaDataConstants.SECURE_PAGE not honored by Tapestry security

I have a pretty simple authenticated page...

@RequiresRoles(logical = Logical.OR, value =

)
@Secure
public class TapPage

When the page is redirected to the login screen (no authentication yet) and is called from plain old http:// URL,
the login screen is shown, but it's still the http:// protocol that is used.

According to the Tapestry documentation @Scecure redirects to https:// URL if the page is already not called through https.
This works, until tynamo security gets involved and points to the login screen
This should work not only with @Secure, but also with MetaDataConstraints.SECURE_PAGE in the configuration
so a lot of pages can be secured at once.

Thanks!