don't alter form action unless required

If a form is delivered to a user then she must already be on HTTPS if she has one of the HTTPS secured roles (forced redirect in hook_init()). So it does not make sense to check that again in hook_form_alter(). Patch attached.

This also solves an incompatibility with the overlay module for me, as the overlay javascript considers a form action beginning with "https" to be an external URL. So it changes the form target to "_new" which opens a new window on form submission, which is really confusing.