Ok, here's an update after some more mucking around...

Setting the "loginUrl" attribute to "https://<server>/Secure/login.aspx" 
seems to work now. The Windows login dialog box doesn't come up anymore if 
you allow anonymous access to the Secure folder. Do that by putting 
another copy of Web.config in Secure.

However, if you call the RedirectFromLoginPage method in the login page, 
it will use the same protocol used to access the login page, which is 
https in this case. Hence, You will need to do your own redirection with 
http if that is what you want. Case closed.