Only use secure cookies over HTTP