Not logged in when using http
Users which have logged-in via https should always be served content via https otherwise there is no point in having the login form use https at all. With http anyone can intercept the cookie and use it to get to the users’s account without even knowing the user and password. The question here is probably … Read more