I have a web app without SSL (I know it's not good, I try to take it as a challenge). The login is two step. First the admin sshs into the server and runs a maintenance companion program that provides a one-time (securely) randomized link. The one-time link leads to a login form. The one-time link is good for just 1 get of login form and 1 form submit.
Does this actually give me more security? Could I do better?