Interesting. SESSION_COOKIE_SECURE has a different intention, but I bet the truth table for these two things is identical. i.e. Whenever SESSION_COOKIE_SECURE is True, you want ssl_required to require ssl. I can't think of a case where they diverge.

I'm +1 for that. That's a way easier fix than what I was thinking of doing.