Torben,
you are spot on. All ecommerce pages should use the same login track.
Ideally, ecommmerce should work with the common OpenACS login track. And it can, but does require some work. I belief that there's a patch in the old bug tracker over at sdm.openacs.org that could serve as an initial start. Hopefully a new ecommerce maintainer can rip out the ecommerce login track and change ec_redirect_to_https_if_possible_and_necessary so that it uses the common OpenACS login track.
In the meantime I would suggest to use ec_redirect_to_https_if_possible_and_necessary with the ecommerce login pages.
/Bart
