We shouldn't be asking this of clients any more. Build the site with SSL on all pages and either require the client buys a cert or implement Let's Encrypt. But at this stage, it makes no sense to make it optional, even for non-commerce sites.