That's what I came here to say. You almost might as well not use SSL at all if you're not going to set the secure flag, because the same vulnerability that makes "FireSheep" work also allows you to intercept requests and coerce cookies out of them.

Of course, there's no trivially installable exploit with a pretty UI that plugs into Firefox to do that yet, so it'll be at least another few years before anyone takes that attack seriously.