title: Can https fallback to http and security level of https
body: <p>I am considering installing SSL/TLS for my domain. There are two questions that have been bothering me:</p>
  
  <ul>
  <li><p>Is there any scenario where a https connection can fallback to http? So, for e.g. if my ajax looks something like this</p>
  
  <pre><code>$.post("https://foo.com", function(){ 
  
  });
  </code></pre>
  
  <p>Is there any chance this could change to </p>
  
  <pre><code>$.post("http://foo.com", function(){ 
  
  });
  </code></pre>
  
  <p>and even if it does would my domain be still accesible at <a href="http://foo.com" rel="nofollow">http://foo.com</a> ?</p></li>
  <li><p>Next I have read extensively about using SSL/TLS and from what I have read it seems to be fairly accurate to assume that if I have this enabled and even if I send the user credentials in plain text, it's still secure (There would be encryption with salt and everything on the server of course). To what extent is this true and would creating a hash on the client and then sending it over https be any more secure?</p></li>
  </ul>
  
  <p><strong>Update</strong>: If sending plaintext over SSL is secure enough, then what really is the point of using things like cnonce ? Isn't it just unnecessary overhead on the client?</p>