Configure CSRF_COOKIE_SECURE & SESSION_COOKIE_SECURE when use_ssl is true.

If an operator is using SSL for Horizon(as they should be), we should ensure the
secure flag is set on the Django csrf and session cookies. This ensures the
cookies are only sent to the server over HTTPS connections (assuming the browser
the user uses respects the RFC)... also the local_settings file suggests the
operators set these to true.

You can read more about the secure flag here:
https://www.owasp.org/index.php/SecureFlag

Change-Id: I92dbaf94c7c4d1070d8a2a9dfc6511c0e88bc2c4