Also pointing out that this data would be nice to have in the monitor events.

Yikes! Sorry you're having to deal with that, because that shouldn't be an issue. Heartbleed was an issue 5 years ago... not so much anymore . New SSL certs are cheap (even free!) and take 15min to deploy. Being brutally honest here, this sounds like a lazy excuse from those departments/site owners ...

I would vote for always https if it is not configurable in the interface (I know you love when we suggest more settings!). I'd be curious to hear @michaels87915107 's reason of never serving over https for security reasons?

Since there is a security aspect to this, but Jenn is mentioning a good point with editing rules/code, what about a popup that comes up with a minute or two left before the session expires to see if you want to extend your session?

Would love to see this as well, it's easy to miss since it is so far below the fold.