When I work on elmo I use `https` and a local domain that points to 127.0.0.1. It's a fake cert I run in my nginx locally. Makes it possible to run with `SESSION_COOKIE_SECURE` and `DEBUG` both to true. 

This if statement should be upgraded to do something like:

```
if settings.SESSION_COOKIE_SECURE and not request.is_secure():
     ...
```