non-https login (user+password) - have flag to enable

by default, users can't login without https, but if admins realy want to, they can knowingly enable the option to login over http.

Start by locating the login flow and the existing HTTPS enforcement or configuration in the Clojure project. Confirm how login transport is currently restricted before deciding where an administrator-controlled option belongs. Done means HTTP login remains disabled by default and works only when the explicit option is enabled.

Written by the indexing model from the issue text.