cart does not add this because not all gateway services require it.
if you use one of the remote checkout services, HTTPS is not needed.
if you look at the first response, they give a php code example that you can use on individual pages to force some pages to HTPPS:
if($_SERVER["HTTPS"] != "on")
header("Location: https://" . $_SERVER["HTTP_HOST"] . $_SERVER["REQUEST_URI"]);