secure cookies are only for production

SSL cookies should only be enabled for production or else you can't test locally using vanilla HTTP