This question does come up quite a bit here.
I think proper alerting would make sense here
and here is how I propose it to work:
if $config_https_only
is set to true in config.php (in which it is by default) and itflow is being accessed via http:// then show an error on the login page stating you will not be able to login because see documentation here