Facebook doesn't force HTTPS for login

How so ? Do you mean by default ? Are you sure you have Secure Browsing (https) enabled in the settings ?

https://www.facebook.com/editaccount.php > Account Security