http://agilewebdevelopment.com/plugins/ssl_requirement looks like a good fit. I'll play around with it and post any good results.

I was actully thinking about something (that I think is ) simpliar - e.g. in the application control have:

def switch_to_https
    if request.host=~/localhost|127.0.0.1|test\.host|www.example.com/
      return true
    else
      if request.protocol != 'https' and not request.ssl?
        redirect_to :protocol => 'https'
      end
    end
    true
  end

and then in each controller, where you don't want to force ssl, e.g. in the unattended controller:

  before_filter :require_login, :switch_to_https, :except => :kickstart