Regarding Pandora, their login form is also served over HTTP instead of HTTPS (http://www.pandora.com/account/sign-in), which I find to be very disappointing, since it's less secure that way.