Force usage of cookie_secure

Cookie connection should be forced to secure connection, see also OWASP recommendation about that: https://www.owasp.org/index.php/PHP_Configuration_Cheat_Sheet