Okay. The session cookie is marked secure and is sent only in response to HTTPS requests. That should cover everything.