Browsers are blocking the content. The problem is that services like missingpadlock.com don't recognize this type of insecure content as "mixed content" because of the incredibly-narrow definition of "mixed content" currently being used.
Mixed Content, to clarify the intended browser's policy on pages loaded over HTTPS and linking content over plaintext HTTP