title: Tomcat, keep session when moving from HTTPS to HTTP
body: <p>I have a Java application running on Tomcat 6.0.29, with Apache 2.2.3 in front.
  The login page uses HTTPS, while most pages use HTTP.</p>
  
  <p>If a user tries to access a page (HTTP) that is login protected, he gets redirected to the login page (HTTPS), logs in, then gets redirected back to the originally requested page.
  This works great, as the JSESSIONID cookie is set as non-secure, and used for both HTTP and HTTPS.</p>
  
  <p>However, if the user starts at the login page (HTTPS), the JSESSIONID cookie is set as Secure, and thus the session is not available after login when redirecting to pages under HTTP, forcing a new session and redirect to login page again. This time it works though, because this time the JSESSIONID cookie is set as non-secure.</p>
  
  <p>How can I avoid that users have to log in twice when they hit the login page first?</p>