tpac: catalog does not immediately recognize "stay logged in" users

TPac fully recognizes logins across sessions, but only on SSL connections for security reasons. Most/all TPac connections currently start as non-SSL connections due to the way people and browsers load pages by default.

Thus, there are only two ways to "solve" this that I can think of:

1 - Force all TPac use to be over SSL, in general
2 - Create a secondary cookie that is visible on non-SSL connections that says "we were logged in" and force SSL usage in that case

I personally recommend #1.

I am inclined to go with solution #1 as well. SSL by default. SSL everywhere. (And not that cheap, 40-bit junk, either.)

Surely #1 would really hurt busy sites, or those with webserver hardware only marginally adequate to their current load. I must definitely vote for #2.

KCLS would also vote for # 2 and as of late have been getting a lot of patron complaints about this issue.
Is there anyone willing to code # 2 for a fix to this issue?
Thanks

I plan to tackle option #2 above.

working code in user/jeff/lp957375_recognize_logged_in_users

looking for testing and signoff

force pushed due to a minor descriptive error in the original commit message. new commit is d8f602036fd2b24a7e8f2c7fb2f1a520b807f149

this backports cleanly to rel_2_2

Thanks Jeff. This worked well in my testing, and I think it's the kind of thing that people expected to be there all along, so I think it's bugfixy enough for backporting into rel_2_2, which I have done.