fix(auth): restrict non-secure cookie fallback to development environment

Author: nyxsky404

src/middleware.ts

@@ -245,10 +245,9 @@ export async function middleware(req: NextRequest) {
       : "next-auth.session-token",
   });
 
-  if (!token) {
+  if (!token && !isProduction) {
     // Fallback: try the opposite cookie name to handle edge cases such as
-    // a production build served over HTTP (e.g. a staging environment without TLS)
-    // or a dev build that somehow received a Secure cookie.
+    // a dev build that somehow received a Secure cookie.
     token = await getToken({
       req,
       secret: process.env.NEXTAUTH_SECRET,