[rubendev]

If you only secure the login you will be sending your session cookies unencrypted for the other pages and they can be intercepted and used to impersonate you.