What about servers setting the secure flag on their cookies and redirecting to https?