https should be used just about everywhere. We should no longer be assuming that we live in a world where people won't fuck with you. If you don't have https then someone can change your website so hard... that you're basically allowing someone to use your credibility to speak to your visitors.

The social engineering potential is limited only by imagination.