+3  A: 
<%= form_for  user, {:url => https_path} do %>
...
<% end %>
Lichtamberg
Did that help you?
Lichtamberg
In pointed me in the right direction, which is that I had to make sure that the form was submitting to an https path. I achieved it as detailed in my question edit though. Thanks.
John Topley
+2  A: 

Since Firebug is an extension inside Firefox it probably sees the request data before it gets encrypted. If you want to test this properly you should use a tool outside of Firefox.

Roger Ertesvag
Your statement is correct. I tested it one some other sites that have secure forms and the field contents appear as plaintext within Firebug.
John Topley