Chris,
On filers running ONTAP versions older than 7.0, or when changing passwords for vfiler users or when using the Password Management UI in Operations Manager, SSH is used always (passwd command). If it is not enabled on the filer, it will fail.
When using Host User Management UI on filers running 7.0 or newer, it depends on whether HTTPS is enabled on the filer. If it is, then HTTPS will be used. If not, then HTTP will be used (to invoke useradmin-user-modify-password API).
Thanks,
Raj.