Torben,
AFAIK ecommerce still uses its own login pages. The switch from http to https doesn't really matter in this case. What IS important is that ecommerce issues its own session ID. The ID is issued as soon as you visit ecommerce pages.
Pruchases are placed in a shopping card linked to this ecommerce session ID. Losing the card's content is the result of losing the ID during login. Trace what happens when you login. Which set of login pages are used? The ecommerce pages or the subsite pages? In OpenACS 4.6.3 the subsite pages would clobber the ecommerce session ID. I belief that the ecommerce session ID is called ec_session_id.
Good luck.
/Bart
