Some quick notes on some recent research.

Specify pages which should redirect from http to https programatically, which can help out in a test/staging environment:

http://www.codeproject.com/KB/web-security/WebPageSecurity_v2.aspx

http://weblogs.asp.net/pwilson/archive/2004/12/23/331455.aspx


Cross-Domain Scripting, IFrames, SOP (Single Origin Policy) and JSONP

http://remysharp.com/2007/10/08/what-is-jsonp/

http://www.zackgrossbart.com/hackito/jsonp-sop/

http://sazbean.com/2009/02/11/json_and_the_argonauts/

http://softwareas.com/cross-domain-communication-with-iframes

Embedding a script from another domain into your page (example GoogleAnalytics):

<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl " : "http://www ");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
var pageTracker = _gat._getTracker("UA-xxxxxx-x");
pageTracker._trackPageview();
</script>