[Zope-dev] Rejecting HTTPS-only cookies over plain HTTP