Cookie injection from non-secure context

Curl allows injecting cookies over insecure HTTP connection that will then be sent to the target site when connecting over HTTPS.

            /*
             * A non-secure cookie may not overlay an existing secure cookie.
             * For an existing cookie "a" with path "/login", refuse a new
             * cookie "a" with for example path "/login/en", while the path
             * "/loginhelper" is ok.
             */