While fixing loginhttps I have noticed several problems related to course themes and languages, the problem is in incorrect use of global $COURSE and $course and theme setup. For example the themes were setup up in print_header() but sometimes $CFG->pix and other variables were used before the print_header() which resulted in pictures without https on pages that required https.
I am about to commit patch that creates new course_setup() function that sets up all course related global $CFG variables, changes locale and setups themes. These tasks are now in several places (setup.php, print_header()). It is called first from setup.php to set up default site theme and locale and then from require_login() to change it to course settings if present.
I have also found several other forgotten global $course issues...