Only set secure flag for SSO cookies set over secure connection.

The "Secure SSO Cookie" setting ensures that anytime a SSO session is started by Drupal (e.g., a user logs in via a Drupal interface) the SSO cookie created by the module, and sent back to the browser, will have the "secure" flag set on it. It will therefore later only be sent by the user's browser over https. However, if a Drupal session is started over an insecure connection, the cookie will initially be sent to the browser in the clear, despite the fact that is has the "secure" flag.

The module simply uses setcookie() to set the SSO cookie during a Drupal-based authentication. However, if the "Secure SSO Cookie" setting is active it does not also verify if the current request is secure before calling setcookie(). The php setcookie() docs states the following about secure cookie creation:

On the server-side, it's on the programmer to send this kind of cookie only on secure connection.

The module it simply not doing that.

I'm not categorizing this as a private security issue because it can only be a vulnerability if sessions are allowed to be initiated over http. This is a condition by which session hijack risks are already inherit, and data that is equally sensitive to the SSO cookie (such as the actual user's credentials) is already flowing in the clear. This means that there is no new security vulnerability here, just the potential for some buggy business logic:

1. If the "Secure SSO Cookie" setting and the "Log out if cookie is deleted or changed" setting are enabled together the user will be logged-in and the immediately logged-out over http (the cookie set over http will be inaccessible via http), this breaking authentication entirely.
2. If the "Secure SSO Cookie" setting is active it's confusing that the same SSO session can be used to start separate http and https sessions in Drupal (by default Drupal tracks these as separate sessions). The "Secure SSO Cookie" setting should help enforce this separation between protocol-specific local sessions.