Default session and CSRF cookies to be secure.