Being a feature to protect the client from fraud, SSL ought to be turned on ALWAYS and be on by default. I keep wondering why some website aid vulnerabilities. Cheers!