Remove :secure cookie from Set-Cookie resp header

- Bump version, so as not to break 1.0.0 :secure behavior