Remove requirement for SSL in session tokens

I spent a decently long time tracking down why this particular application was silently failing to login on heroku, and it turns out that it was because the defaults demand SSL for session tokens. As Heroku does not offer any free SSL add-ons (to my knowledge), it would make this particular cookie-cutter much easier to initially deploy if the app did not have such a default.