Never mind the fact that if any of the authenticated traffic goes over the wire in the clear (post-login), The Great Firewall could snarf sessionIDs and replay them. This is the concept used in Errata Security's Hamster/Ferret tools. You don't need a username or a password to read their gmail, update their facebook status, or anything. And if any part of the session happens without https, the whole session is at risk.