User links changed to https

[lurkalot]

For the benefit of others.   It turns out there was a setting in the server control panel, under security settings called 'External Links Rewrite'

"The additional External Links Rewrite option ensures that your website will not show any "Mixed content" warning in the browser due to insecurely loaded external resources."

Disabling this appears to have solved the mystery, and now the links behave as expected.