detect sslcookie set and no https

detect sslcookie set and no https

This is likely a misconfiguration and can cause login to fail as the
browser refuses the send the session cookie back over http.

Not entirely happy with putting the check where I did, since users have to
try to log in, and fail, to see the misconfiguration explained. But I could
not find a better place to put the check.