[by]

It is very poor security to teach your users to enter their passwords on HTTP pages. Even the small minority of technical people who check the page uses HTTPS when it posts the form do not check it every time they use the page.