It's possible to mitigate HTTP session hijacking without resorting to SSL: http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-to-mitigate.html http://ca

It's possible to mitigate HTTP session hijacking without resorting to SSL: http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-to-mitigate.html http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-t... It's not really viable to serve most things over HTTPS because there's no hope of caching anywhere but at the end-point (and that's usually disabled by default, too).