Set the 'secure' option on session cookies

This was an outcome of the penetration test.

Setting this tells the browser that the cookie should only be sent over HTTPS:
http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly