[_ck_]

Did you look inside the login-form.php template?

You might be referring to the 2nd one inside the failed login form which is probably in the core.

A plugin might be able to fix this problem by detecting if the user is in HTTP vs HTTPS mode and filtering bb_get_option_uri – this intrigues me so I might write it and post it here shortly.