set Secure flag on cookies if running with HTTPS