Do not set session.cookie_secure on SSL requests for sites < D7