Derive cookie Secure and CSRF strictness from the request transport (closes #269)

internal/server/sentry.go

@@ -147,10 +147,13 @@ func sentryRoutePattern(hint *sentry.EventHint) string {
 //
 // The scheme is load-bearing and is kept: the SDK derives it from
 // r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https"
-// (interfaces.go:180), byte for byte the predicate
-// internal/middleware/csrf.go uses, so it is the CSRF TLS decision and
-// the reason dropping X-Forwarded-Proto from the header allowlist
-// costs nothing. The host is parsed.Host of the SDK's
+// (interfaces.go:180), which is the reason dropping X-Forwarded-Proto
+// from the header allowlist costs nothing. That predicate is the SDK's
+// own and is stricter than reqtls.IsTLS, which this service now uses
+// everywhere it decides transport: the SDK reports "http" for the
+// "HTTPS" and "https, http" spellings reqtls accepts. Only a reported
+// scheme is affected, no decision is, so it is left to the SDK rather
+// than reimplemented. The host is parsed.Host of the SDK's
 // scheme://r.Host/path, so it is whatever the client's Host header
 // carried: this service validates no hostname. It is kept because that
 // same header is on the allowlist, so scrubbing it here would withhold