When accessing the Portal for ArcGIS Home page through the ArcGIS Web Adaptor, and logging in to the site using a built-in account, a HTTP request is sent through when HTTPS-only connections are enabled in the portal. The URL passed through is of a page that does not seem to exist, and even though the page does not exist, users are still able to retrieve the username and password since the communication is not encrypted.