Advanced session hijacking mitigation

utilizing ssl_session_id (when mod_ssl is enabled) and ip/user-agent
when using raw http connections an additional check is done to ensure
that cooked are not copied between systems thus preventing session
hijacking

If a user with a valid CAS session attempts to copy another user's
cookie the existing CAS session will simply reestablish and the stolen
cookie will be invalidated.
While this could potentially create a denial of service; the risk is
limited to non-https connections.

In addition the isSSL function now utilizes the mod_ssl optional function ssl_is_https 
Right, what I'm asking is, suppose you have an Apache server with 2 modules capable of handling TLS loaded - mod_ssl and another one (there used to be some commercial versions).  Since mod_ssl is loaded, this function will be registered, but since mod_ssl may not be handling SSL, it would return false.  The schema comparison seems safer to me since it would be uniform across anything responsible for handling SSL.