Another good reason for sites who don't think of themselves as needing security to go HTTPS-only. MITMs who you wouldn't normally think of as attackers (e.g. Comcast) will screw up your site for your users.