So what what you mean to say is that if you don't use SSL all the time, somebody with a sniffer can pull you session ID out of the air and impersonate you by hijacking your session.

That's VERY different for a man-in-the-middle attack.

Do you think the coffee shop should have offered encrypted wifi?