So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hi

So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hijacking your session. That's VERY different for a man-in-the-middle attack. Do you think the coffee shop should have offered encrypted wifi?