There are too many security holes and corner cases to serve <i>any</i> authenticated page over http. It&#x27;s better to have your login page be served over https, but if you use authentication cookies, any MITM can easily pick them up from the following http pages and do what they want (for as long as the cookie is valid).<p>And that&#x27;s beside a whole rake of issues from having http and https on the same domain. It&#x27;s just easier to have https everywhere.