My first job out of college passed the authentication over SSL/TLS, but the page that *contained* the login form? That was sent in the clear.... Truly dark days.