set 'secure' flag on session cookie when using https

seems i missed pushing this file when i added other failed login stuff.