Even assuming you're only referring to leakage of user passwords and/or session ids (btw "secure" includes a lot more than that)...
There is simply no secure way to send a user password over the Internet in the clear, without benefit of a proper encryption protocol. Without using TLS/SSL, you'd be forced to implement this yourself - which, at best, would be insecure.
Likewise, the user's session identifier would be equally exposed, if not restricted to HTTPS only.
That said, the above all assumes a website on the public internet.
There are certain other situations which can be secured without TLS/SSL:
- Internal (e.g. corporate) website, that is protected using IPsec.
- A local website, on the same machine that the user is browsing from, accessible over the loopback interface only (and dependant on the machine being in use by a single user, not e.g. a shared terminal server).