Server: make the session cookie transit only over ssl when needed