Automatically infer Secure attribute for sessions that are started on an SSL connection. See #368.

Also introduces a new overload for HTTPServerResponse.startSession that takes SessionOption enum instead of boolean values.