Fix secure cookie set for http requests.

lua/callback.lua

+local headers = ngx.req.get_headers()
+local scheme = headers["x-forwarded-proto"]
+if not scheme then
+   scheme = ngx.var.scheme
+end
+local secure_flag = 'Secure; '
+if scheme == 'http' then
+   secure_flag = ''
+end
+
 ngx.req.read_body()
 local args, err = ngx.req.get_post_args()
 if not args then
@@ -8,5 +18,5 @@ end
 local session = args['SessionId']
 local returnTo = args['ReturnTo']
 
-ngx.header['Set-Cookie'] = 'session=' .. session ..'; path=/; Secure; HttpOnly;'
+ngx.header['Set-Cookie'] = 'session=' .. session ..'; path=/; ' .. secure_flag .. 'HttpOnly;'
 return ngx.redirect(returnTo)