I find it rather depressing that all websites have to be fully https solely because we can't protect one user identity cookie.