Thanks for the credentials and for setting up a separate demo site. I tested on the site, and the popup actually appeared in SSL for me, as it should. I did some testing, and think I found the issue though. Can you log in to Facebook.com, and then go to:
www.facebook.com/settings?tab=security
Check the setting you have for "Secure Browsing". It should be "enabled", which is the default. When I disabled it, the popup on any site appeared in a non-SSL window. That's a user-preference setting, and not something we can override.
Hopefully, that's the problem and you'll be all fixed up. If you need more help though, just let us know.
Thanks,
Alex