WebSession: fix cookie issuing WRT HTTPS

• If a user was logged in (and hence served via HTTPS) and he then visit an HTTP URL (thus not providing his session cookie) don't issue a new session cookie, as it was introduced by mistake with commit c95063779a2c5f807df963babfcbc36141d8d3fa.