The problem with enabling SSL by default is that some (disfunctional) "corporate IT" departments block HTTPS traffic through their proxy servers as a control mechanism. We have SSL forced on our clients who are mostly government and semi-government agencies and we often have to ask them to whitelist our sites. I even asked one client "... so that means I cannot do internet banking while at work" and the response was "management has only authorised internet banking to the accounts team and they are the only ones allowed SSL". Makes you wonder how they then establish an online presence via Facebook/Twitter.