Two suggestions...

[ephigenie]

we integrated squirrelmail.
(instead of horde)

thats because squirrelmail is secure, active developed (yes i know horde, too) and a lot of enhancements were available.
You're free to make a theme for horde, too - then we can present our users a second alternative.
For now we made a theme for squirrel - and i think thats miles better already than uebimiau or whatever this mail app was called with the discontinued development since 2002 (which is the mailer in vhcs2) .

And squirrel is compatible to most browsers (only few javascript used etc) .
Our Intention was to provide a stable alternative.
We've probably have to look that we can support the debian squirrel - package as well but thats something far away atm because the squirrel we use is actually enhanced a lot.

Regarding your first question :
we thought that making the panel(login) a separate vhost (defaults to admin.yourdomain.tld) is a good idea (and needed because only that SuExec user (vu2000) may access the files of the panel.
You're free now to add https to that vhost, too.
(later we will integrate a SSL - wizard maybe as well for the panel itself)