Fix #940

If we set 'secure' for the session cookie when https is in use (i.e., in
production and not in dev) then we should never get a session cookie on
a request for http://www.gittip.com/, and consequently we won't set an
empty session cookie on the subsequent 302 response redirecting the user
to https://www.gittip.com/.