After setting cookie_secure to True, BrowserIdManger keeps accepting already set cookies through plain HTTP

[Servilio Afre Puentes]

It is contradictory/inconsistent to configure the BrowserIdManager to send cookies only over HTTPS and still accept some of them (the ones already set before the configuration change, so this set is built randomly/non-deterministically) over plain HTTP.

The consistent behavior for this property is to delete cookies sent over plain HTTP once the cookie_secure attribute has been set to True (thus forcing regenerating the browser ID), and conversely, when set to False resending the same cookie with the secure attribute off.

The attached patch implements the first case.

[Servilio Afre Puentes (servilio)]

Also, no test is implemented yet.

[Colin Watson (cjwatson)]

The zope2 project on Launchpad has been archived at the request of the Zope developers (see https://answers.launchpad.net/launchpad/+question/683589 and https://answers.launchpad.net/launchpad/+question/685285). If this bug is still relevant, please refile it at https://github.com/zopefoundation/zope2.