Set the 'secure' option on session cookies

This tells the browser that the cookie should only be sent over HTTPS:
http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

This was an outcome of the penetration test.
Merge pull request #110 from alphagov/secure_session_cookies

Set the 'secure' option on session cookies