There may be only a few forms that have passwords, but every request includes your session cookie. An eavesdropper could hijack your session. If I want to bro

There may be only a few forms that have passwords, but every request includes your session cookie. An eavesdropper could hijack your session. If I want to browse with TOR, it's pretty likely the exit nodes are sniffing my data. It kind of defeats the purpose of using TOR if I can't stay on HTTPS.