If we're using a dev domain (i.e. non-SSL), don't use HTTPS-only cookies
Merge pull request #7 from theodi/bugfix-secure-sessions

Bugfix secure sessions