Looks like I've found another bug;
Something is interfering with XCart's normal redirection to HTTPS url's when proceeding from the cart to the checkout, if "Use HTTPS for users' login and registration" is turned on, as the subsequent checkout process remains normal HTTP.
(EDIT: "basket" means "cart" for those of us this side of the Atlantic
)