This is why login forms themselves must be opened over an HTTPS connection. Displaying a login form over HTTP which POSTs to HTTPS is easily MITMd.
Think of your users. Some of them will be accessing your sites from oppressive regimes. Let them do so safely.
Taking Facebook as an example, considering how global their usage is, and the amount of sensitive data peoples accounts contain, it's unforgivable that they don't force HTTPS traffic for everything.
Unfortunately, that is easily defeated by modifying all non-SSL pages on the site to link to a non-SSL login page look-alike (which is easily generated by downloading the real one over SSL and forwarding it decrypted). I don't see any reasonable way to solve this other than /always/ using SSL for your site.
Think of your users. Some of them will be accessing your sites from oppressive regimes. Let them do so safely.
Taking Facebook as an example, considering how global their usage is, and the amount of sensitive data peoples accounts contain, it's unforgivable that they don't force HTTPS traffic for everything.