removed requirement for security from session cookie

Default heroku deployments don't come with SSL enabled, and there are not (to my knowledge) any free SSL add-ons. It is therefore easiest to deploy without the security requirement.