Set Secure attribute on cookies if needed.

This allows cookies only to be used on HTTPS based sessions.
It prevents 'sniffing' of cookies. This was done in InterfaceAgent
and InterfaceCustomer but not yet in cookies created via
SwitchToUser and SwitchToCustomer.