SESSION_COOKIE_SECURE gated on an env var gives an escape hatch but no diagnostic. An operator who leaves it secure on a plain-HTTP install sees a login form that accepts correct credentials and redirects back to itself with no message. The wizard or the login view should detect a request over http with secure cookies enabled and say so. Follow-up to #127.
SESSION_COOKIE_SECURE gated on an env var gives an escape hatch but no diagnostic. An operator who leaves it secure on a plain-HTTP install sees a login form that accepts correct credentials and redirects back to itself with no message. The wizard or the login view should detect a request over http with secure cookies enabled and say so. Follow-up to #127.