Fix login/registration over `http://localhost:5001` on Docker Desktop.
The session cookie's `Secure` flag is now driven purely by the request
protocol (HTTPS) rather than by source-IP heuristics, so HTTP requests
from any IP — including Docker Desktop's NAT gateway — now keep their
cookies and CSRF tokens.
