You don't want to use cookies sent over insecure channels for session management. By keeping a default of true, developers are forced to consider their implementation.