Normalize and Vary on the forceHTTPS cookie

We move most cookies out of the way since Varnish doesn't support
X-Vary-Options, but forceHTTPS we do need to vary on.

Change-Id: Ibc47e96e7725170486286def7e7c5c8f28d0c892
Merge "Normalize and Vary on the forceHTTPS cookie" into production