added option to make remember_token cookie secure

This is important if you have an app running on HTTPS, otherwise the auth cookie is leaked when you visit a HTTP URL and can be intercepted. Even if your whole app is on HTTPS and http://app only redirects to https://app, the cookie would be leaked in that redirect request and it would be enough to hijack the user's account.