Basic Authentication And HTTPS

I want to use basic authentication, but protect the login process from snooping by means of https. However I dont want to use https for the whole application ( its a cpu eater... ), so I thought I would set the thing up to : 1 access the login page ( say login.php) via https and use header() to get $PHP_AUTH_USER etc ( more or less as in the php3 documentation) . 2 use header() again to redirect to the start page ( say start.php ) but use http. The problem is that as soon as the switch from https to http occurs $PHP_AUTH_USER etc are unset. Is there any way for http to see these variables set using https ? - or would this mean that they are passed in plain text after the switch to http ? I wondered about using cookies to save $PHP_AUTH_USER and PW...? Any comments would be welcome.