Chrome is about to support a new security feature called Strict Secure Cookies which prevents secure cookies from being created or overwritten via HTTP. When a MediaWiki installation supports both HTTP and HTTPS and has $wgSecureLogin off, this change will break HTTP login on machines which were used for HTTPS login in the past.

The easy fix is to splice the protocol into the cookie name. The nice fix is to murder $wgSecureLogin for which IMO there is no good reason to support in 2017. Sites which support both HTTP and HTTPS should never log users in via HTTP, period. (The most recent Chrome and Firefox versions even display a warning when you try to type onto a password form field on a HTTP connection.)