The page the frame is on and the page you are loading into the lightbox (signin.aspx) must both be on the same domain (including protocol). This is called the Same Origin Policy.
If you want the popup to always be the same protocol, use a protocol-less url:
//example.com/signin.aspx
This will then use the protocol of the parent document (http or https)