Change Context::isAlwaysSSL() to config('session.use_ssl_cookies')

- Main session cookie is httpOnly if use_ssl is true
- SSO cookie is always httpOnly

common/js/common.js

@@ -1056,7 +1056,7 @@ function setCookie(name, value, expire, path) {
 	var s_cookie = name + "=" + escape(value) +
 		((!expire) ? "" : ("; expires=" + expire.toGMTString())) +
 		"; path=" + ((!path) ? "/" : path) + 
-		((enforce_ssl) ? ";secure" : "");
+		((cookies_ssl) ? ";secure" : "");
 
 	document.cookie = s_cookie;
 }