added setting for the 'secure' flag on the session cookie when ussing https