Addressing the thread title - is https needed? - the technical answer is 'not necessarily'. But the technical answer is rather irrelevant: if you want it to look professional and for people to trust it, and be happy to enter their details and subscribe to the mailing list, you really ought to use https and lose any 'insecure' warnings. (I know that the newsletter link itself is https, but you can't expect Joe Public to understand that.)

Accessing that auburn site here on Firefox mobile I get no security warnings, apart from an open padlock, but maybe I would if I delved deeper. Firefox will generate 'mixed content' warnings under some circumstances as described here. That link helps answer the headline - the difference between active and passive content. But - bottom line - you ought to use https on that site.

That doesn't mean every site needs to use https. It depends not only on the content but on the userbase.