Set cookie secure flag

closes #1680
- added secure flag for cookies if SSL is forced