I recently tried to update my credit card information on a site that is served over HTTP. Even after login the site stays on HTTP!
I noticed that Chrome would not let me use the saved credit cards for this reason.
Upon contacting the company they replied that the payment window itself is hosted by the payment provider, and served as a modal via HTTPS.
I just can't see how this is safe, because anyone could easily do a man-in-the-middle attack and replace the modal with their own form and retrieve the card information.
I then contacted the payment provider, but they too had no problem accepting HTTP referer and callback addresses to/from their payment page. I came up empty when looking at the PCI compliance requirements, because they do not describe requirements for hosted solutions, as in this scenario.
EDIT: I made this screen capture to add some clarity to the scenario: Man-in-the-middle demonstration
The keys are logged on the login form and the "secure" credit card form is replaced by an image the second time it is loaded.