rbsom - portals, by default are https, for the exact reason the users are complaining about.
When you give them a link to sign into the portal, is that link https or http?
Also, if you edit the portal under Customize > Portals, what option do you have set for Step 6?
Paul