Concerned organizations say basic flaws in Web-security design may be causing many websites that display padlock icons-designed to show that they're secure-to be unsafe.