After digging into the v2.7.0.beta4 code some more, I see that ApplicationController has a secure_session definition. Changing our plugin code to the following seems to work in our Staging environment:
sso = DiscourseSingleSignOn.parse({ sso: encoded_query, sig: sig }.to_query, secure_session: secure_session)
…Is it really that simple? 