The cautious strategy would be to do SSL everywhere, then think about switching to non-SSL for some pages if (and only if) performance issues arise, that would be likely to be fixed with absence of SSL. Not using SSL means that passive attacker can see all the traffic, and active attackers can modify at will all the non-SSL parts, which can have deep ramifications. Thus, this is not something that should be done lightly. Mixing SSL and non-SSL content within the same page also tends to produce browser warnings or breakage, so doing partial SSL can be challenging.
"Performance issues" that may plausibly arise in the presence of an all-SSL world are about caching; with SSL, transparent proxies that cache data requests as they go, without clients being aware of it, can no longer work. Big ISP are quite fond of transparent proxies. On the other hand, "performance issues" that come to the mind of most sysadmins (namely, the "obviously" huge overhead of encryption) are, in fact, mostly mythic.
The industry practice is of course completely different. The industry, at large, goes without SSL, then adds it only reluctantly, long afterwards, for only some pages, and only after having spent all the excuses about how attacks on non-SSL pages are not their problem since they are client-side. For some reason, many sysadmins think about switching to SSL with the same mindset as an hardcore environmentalist that considers replacing a coal power plant with a nuclear one.