I want to protect the login form of my Rails application using HTTPS. After a bit of a uphill struggle I now have the SSL certificate installed and Apache/Passenger set up correctly.

My application uses [SSL Requirement](http://github.com/rails/ssl_requirement/tree/master) and [RESTful Authentication](http://github.com/technoweenie/restful-authentication/tree/master) in combination for the login form. I've noticed using Firebug that the login credentials are still sent in the clear. How can I make the Rails `form_tag` helper submit the form over HTTPS? I couldn't see anything about this in the docs.

---

**EDIT:** I did some more research and edited my routes file so that the session controller uses HTTPS:

```
map.resource :session, :controller => 'session',
                       :only => [:new, :create, :destroy],
                       :requirements => { :protocol => 'https' }

```

I also changed the login form to use `session_url` instead of `session_path`:

```
<% form_tag session_url do %>
  .
  .
  .
<% end %>

```

—This is correctly using a full https:// URL as the `action` for the generated `form` element, but I can still sniff the user name and password using Firebug. What's going on?!

Thanks.