If a form is created on an HTTPS page with HTML.startForm(), the action is forced to HTTP instead of allowing the event.buildLink() call to detect the current page.
The fix is to not default the SSL attribute to anything. Check for its existence and only pass it along if it has been specified. Otherwise, allow event.buildLink() to default the URL protocol as necessary.
Pull Request to address issue in ColdBox core.
Thanks for linking that here. FYI, is on vacation right now so he'll look at merging this once he's back.