Serving Port 80 and 443 for a web application

There's a Secure setting in the Cookie Options of the APM profile - SSO/Auth Domains tab. This option, when enabled (by default) instructs the browser to only use the APM session cookie over HTTPS connections.

I might caution that if a single access session is to be used across 80 and 443 connections, there's a risk of compromising the HTTPS session if the cookie is stolen. It may be better to isolate the 80 and 443 traffic into separate policies.