A "man in the middle", by definition, sees all traffic between the two victims (client and server) and can alter it at will. SSL (HTTPS) defeats MitM, subject to the usual caveats (the client must not trust a rogue CA, the human user must not click through the browser warnings about an invalid server certificate). If a site is HTTPS-only, then the MitM cannot do anything. If the site is HTTP-only, then the MitM can fake and forge and alter and inspect data at will. If the site is partly HTTPS, then the attacker can play with the non-HTTPS parts.
It is hard to make a mixed HTTP/HTTPS site which resists MitM attackers, because you then need some very clear notions of security boundaries; and the MitM is in good position to do a lot of harm through the non-HTTPS parts of the site. Though the "Secure" and "HttpOnly" flags can keep your cookie values out of reach of the attacker, Web site security is not all about cookies (coookies are a tool, not a goal). It is altogether much simpler and much more secure to "bite the bullet" and go HTTPS site-wide.