Every link in the chain should be over TLS. Otherwise, you can change the unencrypted part to point somewhere else. Both the form, the site linking to it, and the URI it submits to should be over TLS.
As Facebook learned, submitting to an HTTPS server isn't enough, the form must be too. Otherwise you can be man-in-the-middle attacked on the form page. Better yet, serve everything over HTTPS, so people can't change the links.
So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hijacking your session.
That's VERY different for a man-in-the-middle attack.
Do you think the coffee shop should have offered encrypted wifi?
