If someone is snooping HTTP requests and gets hold of your JIRA cookie, this is just as good as a username:password combination - they can log into JIRA as you with it. So in security-conscious installations, cookies over HTTP is not a good idea.

Cookies can have an SSL bit set, which means the browser won't send them to a website unless SSL is used. We should add an admin option to JIRA to use this bit, and only allow SSL-protected users to store a cookie logging them in.