title: how SSL & cookies work?
body: <p>I understand, we use SSL to encrypt sensitive data like user name and password to transported to server without people in the network eavesdropping. So then server returns a secure token over HTTPS and its stored in cookie. We switch to HTTP after we have secure token, we attach cookie/secure token header to every HTTP request. </p>
  
  <p>Now anybody can see my secure token and they can eavesdrop it and impersonate me. Is my understanding correct?</p>