Bug Description

When running n8n over plain HTTP with N8N_SECURE_COOKIE=false set, the OAuth/MCP consent flow fails. The n8n-oauth-session cookie is still being set with the Secure attribute regardless of this setting. Browsers silently drop Secure cookies on non-HTTPS origins, so the session cookie never gets stored. The subsequent request to /rest/consent/details then fails a browserId check, returning a generic "Invalid or expired authorization session" error, making it impossible to complete OAuth/MCP authorization on an HTTP-only n8n instance.

Confirmed workaround: putting n8n behind an HTTPS reverse proxy (e.g. Caddy) resolves the issue immediately, since the cookie is honored once the origin is actually secure. This should not be required when N8N_SECURE_COOKIE=false is explicitly set, since that env var is documented as the way to disable Secure-cookie behavior for HTTP deployments.

To Reproduce

1. Run n8n in Docker with N8N_SECURE_COOKIE=false and N8N_PROTOCOL=http (plain HTTP, no reverse proxy)
2. 2. Enable Instance-level MCP under Settings
3. 3. Configure an MCP client (e.g. Claude Desktop via mcp-remote) to connect via OAuth to http://:5678/mcp-server/http
4. 4. Start the OAuth flow and approve the consent screen when it appears
5. 5. Observe the flow fails with "Invalid or expired authorization session" instead of completing