I had same situation like Doug described above
My solution:
1)Created custom Controller Factory. It's need for getting ControllerContext in my custom https attribute. 
public class CustomControllerFactory : DefaultControllerFactory
    {
        public override IController CreateController(RequestContext requestContext, string controllerName)
        {
            var controller = base.CreateController(requestContext, controllerName);
            HttpContext.Current.Items["controllerInstance"] = controller;
            return controller;
        }
    }
}
2)In Application_Start function from Global.asax file wrote next:
ControllerBuilder.Current.SetControllerFactory(new CustomControllerFactory());
3)Defined custom https attribute:
public class CustomRequireHttpsAttribute : System.Web.Mvc.RequireHttpsAttribute
    {
        public bool RequireSecure = false;
        public override void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext)
        {
            if (RequireSecure && !((Controller)HttpContext.Current.Items["controllerInstance"]).ControllerContext.IsChildAction)
            {
                base.OnAuthorization(filterContext);
            }
        }        
    } 
4)Using new attribute for definition of account controller:
 [CustomRequireHttps]