Yes on that second part... It protects data as it is transferred, so that people trying to snoop the transmission can't read passwords and data that gets sent back and forth, but the stuff like user handling and passwords and sessions are entirely up to the program, and have nothing to do with SSL
                - Ant