Allow the console to be served over HTTP, using session cookies

[smklein]

• We have been serving Nexus' external API over HTTP, not HTTPS. This is a known deficiency, tracked by TLS integration #249.
• Session cookies, which are used when authenticating to the console, use the Secure attribute to ensure that they're exclusively sent over HTTPS.
• @david-crespo has theorized that "this worked anyway" because the console had been typically accessed over localhost, and an exception was granted.

Until HTTPS integration is adopted across the stack more universally, allow the console to be served in the interim. This change is necessary to access Nexus-from-within-a-Zone, as it is no longer accessible over localhost.

This change should be undone once #249 has progressed.

[david-crespo]

Citation on the localhost thing:

A cookie with the Secure attribute is only sent to the server with an encrypted request over the HTTPS protocol. It's never sent with unsecured HTTP (except on localhost)

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies