We do exactly the same thing -- data-sensitive requests sent over HTTPS with a secure cookie, normal browsing over HTTP. At this point it seems difficult to implement site-wide SSL (CDN issues, browser bugs, overhead in SSL).

It seems like an important area of development for the web community to improve the tools and services available to make SSL on regular sites easier to implement. Yes, it's easy to turn on SSL, but there's a lot of nuance in a good implementation.