Secure login screen but HTTP for anonymous traffic

Problem/Motivation

My goal is to secure the login screen and any subsequent traffic by logged-in users to avoid session hijacking. However, we want to serve all anonymous traffic over HTTP for now.

I think I can accomplish this with the Secure Login module and a few .htaccess lines. Here's what I'm currently testing.

# Redirect SSL requests to non-SSL except when:
#   A secure cookie is present with "SSESS." (User is probably logged in.)
#   Requesting a file like images or CSS. Users can still request over SSL.
#   Requesting a JavaScript file. Admin Menu breaks without this line.
#   Requesting a URL starting with "/user." (User is trying to log in.)
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_COOKIE} !^.*SSESS.*$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !^.*js/.*$ [NC]
RewriteCond %{REQUEST_URI} !^/user.*$ [NC]
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R]

Proposed resolution

Can someone look over this code and let me know:

1. Am I forgetting anything obscure that might cause a problem? (Example: Admin Menu would not work until I added JavaScript files to the conditions above. What about AJAX?)
2. Should I be using a different module? I considered 443 Session module, but Secure Login seems to have more momentum.
3. Would you solve the problem a different way?

P.S. We will go all-SSL eventually, but right now I'm just quickly trying to secure the login form and pass a PCI scan.