fix(session): keep old access token on failed store, cap incoming path, fold proto case

SetAccessToken cleared the old token before it found that no request
was available for the chunk cookies. The old token was lost.
The stored post-login path had no length bound and could bloat every
later Cookie header. It is now capped at 2048 bytes.
DetermineScheme compared X-Forwarded-Proto case-sensitively while the
cookie code did not, so HTTPS gave an http redirect_uri.

internal/utils/utils.go

@@ -142,7 +142,7 @@ func DetermineScheme(req *http.Request, forceHTTPS bool) string {
 	// "X-Forwarded-Proto: ftp") would otherwise be emitted verbatim into
 	// redirect_uri as a broken or weakened scheme. Invalid values fall
 	// through to the TLS check (R103).
-	if scheme := req.Header.Get("X-Forwarded-Proto"); scheme == "https" || scheme == "http" {
+	if scheme := strings.ToLower(req.Header.Get("X-Forwarded-Proto")); scheme == "https" || scheme == "http" {
 		return scheme
 	}