Redirect from HTTP to HTTPS when it makes sense

The /login page redirects to HTTPS if accessed over HTTP to avoid sending
credentials in plain text over an unencrypted connection.

The "sid" cookie set by the /validatelogin operation is set with the
"Secure" modifier, which (should) cause the user agent to only send the
cookie over secure connections.  To avoid getting an anonymous page when
loading an HTTP URL while logged in, an additional cookie, "has_sid", is
set (with a dummy value) which, when set, will cause all pages to
redirect from HTTP to HTTPS, so that the "sid" cookie gets sent.
Redirect to /login if user has invalid session id cookie

If the user has a session id cookie that has expired, signing in
again immediately is probably preferable compared to silently
becoming anonymous.
Set Max-Age=<1 year> on all cookies

Without Max-Age or Expires, the cookies set are session cookies.
That was never the intention.  And since sessions time out on the
server (and in a way that a constantly active session never times
out) we can just set a Really Long Timeout<tm> on the cookies.