I have a web app without TLS (I know it's not good, I try to take it as a challenge). The login has two steps: first, the admin sshs into the server and runs a maintenance companion program that provides a one-time (securely) randomized link. The one-time link leads to a login form. The one-time link is good for just 1 GET of login form and 1 form submit.
Does this actually give me more security? Could I do better?