Apps on Facebook require an ssl. You can generate a self signed sl yourself for testing in your website cpanel account. It will generate a warning for the public though so not feasible to self sign an ssl for an app.
Apps on a website(not apps.facebook.com/game) should work fine for logging in and anything that doesn't require the app to be specifically apps on Facebook.
So long story short, I do think if you put your game on dude.com/mygame it should mostly function fine with just http. If you plan on using your app on apps.facebook.com/mygame it will need to have a valid ssl attached. Hope that helps.