Default "secrets"

SSL encrypts both directions of traffic. The first part of this is to establish the identities, usually of the server (the client generally uses a login form to establish their identity). Without SSL encrypting all traffic, someone could potentially steal your session and submit forms on your behalf, ala firesheep.