Patently false. If users submit to the login URL through a link that was sent in the clear, a MITM can just run sslstrip (<a href="http://www.thoughtcrime.org/software/sslstrip/" rel="nofollow">http://www.thoughtcrime.org/software/sslstrip/</a>) and presto, you're visiting the HTTP version of the page instead of HTTPS. The login URL needs to be unavailable over HTTP, as does the login form.