This is one of the many reasons to use an extension that forces SSL on every website that supports it.

It's possible to MITM SSL, but it would throw all kinds of security warnings on the client and prevent this kind of tampering.

Note: I'd recommend SSH tunneling, or using a VPN, but there's quite a bit more work involved here, so for the install-and-forget crowd, SSL is already a huge improvement.