<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41641 & Resolves#44276
When Fleet is served over plain HTTP from a non-localhost host (e.g. a
Docker deployment accessed by IP), login fails with an "Authentication
Required" error.
To reproduce this, I ran the server as follows:
```
./build/fleet serve --dev --dev_license --server_tls=false --server_address=0.0.0.0:8080
```
And then, go to the Fleet UI using my private IP:
```
http://<my-lan-ip>:8080
```
https://github.com/user-attachments/assets/09543b9b-b9ee-4d1c-b47e-ebd49c20c699
The auth token is stored client-side in a `__Host-token` cookie with the
`Secure` attribute, and browsers silently drop `__Host-`/`Secure`
cookies on insecure, non-localhost origins. So, the token was never
persisted and the follow-up `GET /config` (and every subsequent request)
went out without it.
This change keeps the `__Host-token` + `Secure` cookie on HTTPS, and
falls back to a plain `token` cookie over HTTP so the token persists.
TL;DR: this restores the pre
[#40504](https://github.com/fleetdm/fleet/pull/40504) behavior for
non-TLS deployments and leaves HTTPS behavior unchanged.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
https://github.com/user-attachments/assets/e7e838f3-f423-4e28-aebd-5f921af08b00
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where login requests would fail with an "Authentication
Required" error when Fleet is served over HTTP.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Nico
bab14d7eb5