Explicitly clear forceHTTPS cookie when insecure

For sanity's sake, explicitly clear the forceHTTPS cookie in
setGlobalCookies if $secure is considered false.

Also, when initially setting the cookies on login let's honor it if the
user set prefershttps false.

Bug: 54626
Change-Id: Ia7c23c48807a7c75a09fab82ce726f27b179c5bd