Message "Whoops! Your session has expired" after upgrading site

[linuxguy2]

This may help some of you that are getting one of the dreaded Whoop's errors!

Out of the box install of ZC V1.5.6 or V1.5.6a "classic" template (may be relative to earlier versions too )
Did NOT experience this behavior with the "responsive_classic" template which leads me to believe this should be fixed in the "classic" code.
Also failed with PHP 5.6 thru 7.2 versions.

Was getting the "Whoops! Your session has expired" error but only when I clicked on the "Add Selected to Cart" button when in the "All Products , New Products or Featured Products" pages.
The regular "Products Pages" worked OK.
When logged in the message changed to "Whoops! Sorry, but you are not allowed to perform the action requested."
No error messages in the "Logs" folder!

My solution was to change the "config.php" to render in SSL

<?php
/**
 * @package Configuration Settings
 * @copyright Copyright 2003-2018 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * File Built by Zen Cart Installer on Fri Jan 18 2019 16:09:28
 */

/*************** NOTE: This file is VERY similar to, but DIFFERENT from the "admin" version of configure.php. ***********/
/***************       The 2 files should be kept separate and not used to overwrite each other.              ***********/

/**
 * Enter the domain for your store
 * HTTP_SERVER is your Main webserver: eg-http://www.yourdomain.com
 * HTTPS_SERVER is your Secure/SSL webserver: eg-https://www.yourdomain.com
 */
WAS:
define('HTTP_SERVER', 'http://zzzzz.com');
CHANGED TO:
define('HTTP_SERVER', 'https://zzzzz.com');
define('HTTPS_SERVER', 'https://zzzzz.com');

/**
 *  If you want to tell Zen Cart to use your HTTPS URL on sensitive pages like login and checkout, set this to 'true'. Otherwise 'false'. (Keep the quotes)
 */
define('ENABLE_SSL', 'true');

I forget the version and/or plugin but at one time I had to change the HTTP:// to HTTPS:// in one of the php scripts which fixed a similar error.