All sensitive information and functions, including login credentials, session ids, account information, all personally identifiable information (SSN's, health information), sensitive functions, and all administrative functions should be protected with SSL.