Okay, but the primary issue at hand with logins, cookie scope, and multiple realms is well known. It's been happening since
www.audiokarma.org was changed to audiokarma.org (or vice versa), circa 2+ years. Less of an issue that primarily surfaced (at least for me) when dealing with google results. Now that two protocols are in play the issue is 2x, exacerbated by every single link previous to TLS being
http://. Not rewriting or redirecting to one realm under one protocol violates best practices; this outcome was 100% predictable and easy to mitigate barring anything profoundly odd with the server config.
My post simply restated what
@Wildcat highlighted as the issue on day one, though a bit more succinctly with a pseudo-repro case. Sure, people can use my post to compensate for the issue on their own by logging in to the site four times, but the point was to illustrate to the powers that be that the server is misconfigured.
Running ops, including devops and secops, in the premium streaming space, dealing with attack proxies and vectors, etc. on a daily basis, I respectfully disagree on the general sentiments about TLS in this context.