As Facebook learned, submitting to an HTTPS server isn't enough, the form must be too. Otherwise you can be man-in-the-middle attacked on the form page. Better yet, serve everything over HTTPS, so people can't change the links.
So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hijacking your session.
That's VERY different for a man-in-the-middle attack.
Do you think the coffee shop should have offered encrypted wifi?
I am unaware of any protocol semantics that allow an HTTP server to determine how the submitted data was marshaled.