title: Is it safe to turn off SSL after sensitive data has already being sent?
body: <p>I was wondering whether it's safe to change the connection back to http once we are passed the log in or sign up pages. I'm considering this option since the data sent back and forth once the user is logged on to their account is not really sensitive, only the user credentials are sensitive.
  <br/>
  <br/>
  My theory is that the answer is better not to, since the session cookie will be sent insecurely and a third party can catch it and use it while the cookie has not expired.
  <br/>
  <br/>
  I'm I right, or am I completely wrong? Can I get some insight?</p>