Set CentralAuth cookies with correct security

Updated to work the same as I08f67b35f355ef193ae86cb9cca3799e247ead4e

Account for prefershttps pref, wfCanIPUseHTTPS, and if the user came
from an http/https url before the login form.

Change-Id: I67e148b06cbcb4fdb0a589ea6322fb672c4ffc78