Explicitly set the session.secure flag to true
No session secure flag for applications running in DEV mode
Merge branch 'cookie-secure-flag'