SSL is cheap.
Lawsuits may cost you millions.
There's an easy choice.
Just make the entire site secure, and don't bother with the secure.xxx stuff, there's not really a lot of point from a technical point of view, unless that is going to be explicitly handled by a different server.
Seriously, you can pick up a suitable SSL certificate for like $12 from various rapidssl resellers.
Not only are you protecting the username/login details, but also any HTTP session information stored in a cookie, because the cookie transactions will also be SSL encrypted.