Fix issue where accessing HTTP domain would override HTTPS cookie

Summary: This fixes an issue where visiting http://code.redpointsoftware.com.au/ would log you out of https://code.redpointsoftware.com.au/

Test Plan: Applied this patch to a live server and saw the issue go away.

Reviewers: epriestley, #blessed_reviewers

Reviewed By: epriestley

CC: Korvin, epriestley, aran

Differential Revision: https://secure.phabricator.com/D8244

src/aphront/AphrontRequest.php

@@ -305,6 +305,11 @@ final class AphrontRequest {
    * @task cookie
    */
   private function getCookieDomainURI() {
+    if (PhabricatorEnv::getEnvConfig('security.require-https') &&
+        !$this->isHTTPS()) {
+      return null;
+    }
+
     $host = $this->getHost();
 
     // If there's no base domain configured, just use whatever the request