Secure Pages Module or force HTTPS Across Whole Site?
Frankly, I bypassed Secure Pages and just forced all traffic to be HTTPS via htaccess. I prefer all traffic to be forced HTTPS.

SecurePages generally works up front, but I have seen a lot of wacky behavior with it that I just don't bother anymore.