I think we should switch it to look at `settings.SESSION_COOKIE_SECURE` instead. Thoughts?