Why is this page served secure?

[Glenn McCalley <minivend@ns1.bnetmd.net>]

Hi, all.  

OK, our basket.html page is *not* served secure.  On the basket.html 
page, we have a "continue shopping" button that looks like this:

<input type="submit" name="mv_click" value="[L]Continue Shopping[/L]">

[set [L]Continue Shopping[/L]]
mv_todo=retun
mv_nextpage=products
[/set]

When one goes to the basket, all is well.  When one clicks "Continue 
Shopping" one is in fact sent to the products.html page, but as:
https://etc., etc., etc. --and the browser gives the warning "This page 
nad both secure and non-secure elements, etc., etc."

Why is a secure URL being generated?  Note: I found Mike's post in the 
mailing lists about modifying Interpolate.pm, for a non-secure basket, 
but it looks like my version (V3.11) has this change already in it - 
at least I can't locate the code block referred to, and the modified 
line appears to be there instead.

config has:
AlwaysSecure        ord/checkout

Stumped.
Thanks!

Glenn.