plone/plone.protect — comment on commit c35239511d5b86129fecf9805178913ceec3700a
File:  line 0
By iElectric:

This is due to the fact Django generates CSRF token per session and thus needs to differ between http and https requests. Same does not apply to plone.protect, but do correct me if I'm wrong.