What are the best practices for using master pages on websites that serve both secure and non-secure pages?

I have been assigned a task to cleanup an application that is using a master page that is shared by all pages (secure and non-secure).

Secure pages are stored in a sub folder "/Secure" 

They have used a mix of relative and absolute urls and paths on the master page, and all absolute urls use http (not https). That is causing the secure pages to display the "this page contains both secure and on-secure items..." They have also copied most all images to a folder inside "/Secure" so that the reliave image paths on the master page keep working wither the page served is inside /Secure or on the root.

I am advised to get rid of absolute urls, and use relative ones (e.g. don't use http://www.SiteToCleanUP.com/images/log.jpg" but use ~/images/logo.jpg).

So is this a common practice to:

1. Use shared masterpage for secure and non-secure pages

2. Maintian two copies of images and other resources ...