Patently false. If users submit to the login URL through a link that was sent in the clear, a MITM can just run sslstrip (http://www.thoughtcrime.org/software/s

Patently false. If users submit to the login URL through a link that was sent in the clear, a MITM can just run sslstrip (http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/) and presto, you're visiting the HTTP version of the page instead of HTTPS. The login URL needs to be unavailable over HTTP, as does the login form.