The best way to do something like this has nothing to do with the application or website you are serving and everything to do with how you configure your server.
Simply put, do not serve pages that you want to be encrypted via non-encrpyted means.
ie. when someone connects to http://secure.example.com/whatever(http://secure.example.com/whatever) you use a 301/302 or META-REFRESH redirect to push them over to the secure site https://secure.example.com(https://secure.example.com).