Noticed it allows me to browse the site insecurely and send my password from the unprotected login form.
Preference session protected enabled (Preference name: session_protected)
Permalink: https://doc.tiki.org./blogpost11-Protect-all-sessions-with-HTTPS-enabled