The pagure cookie should be set with the secure attribute to make sure it is not sent via unencrypted connections by browsers not supporting HSTS: https://www.owasp.org/index.php/SecureFlag
pagure
secure
This should be set now, the code had the logic, only the configuration change was needed.