It should be noted that even cookies marked 'Secure' will be sent over HTTP for versions of Rails prior to 2.3.10 and 3.0.2.
https://rails.lighthouseapp.com/projects/8994/tickets/5629-s...
And it has been further enhanced recently: http://github.com/rails/rails/commit/2d5a12a50bcd83fcc99865d...