Update.. I have encountered other problems with my approach and decided to simplify things by forcing the entire site to use SSL. So the above is no longer an issue for me.
