I don&#x27;t understand the distinction between the login form and every other page of the site. If someone is logged in and then back to normal http, someone can just grab the <i>cookie</i> and pretend to be that person already-logged-in.<p>I suppose if one uses the same password for every account they have then knowing their password is more harmful than just having access to 1 site... but other than that it seems like a distinction without a difference.