code: private boolean allowToAddCookieToResponse(WebAppSecurityConfig config, HttpServletRequest req) {
          boolean secureRequest = req.isSecure();
          if (config.getSSORequiresSSL() && !secureRequest) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "SSO requires SSL. The cookie will not be sent back because the request is not over https.");
              }
              return false;
          }
          return true;
      }
docs: This method checks the following conditions:
  1) If SSO requires SSL is true and NOT HTTPs request, returns false.
  2) Otherwise returns true.
  
  @param req
  @return