I changed the url i was using to fetch the esri js api to https://js.arcgis.com/3.7 and i can see in Fiddler that the call to that url is going out as ssl. But the file it pulls down (init.js) must be firing off other calls to fetch more components of the api and those are only going over http. Short of hosting the api myself is there a way to fetch the whole enchilada over ssl?
My guess is the JSAPI is not detecting ssl as you document protocol? This may also be a problem specific to running your page through Fiddler.