Set the 'secure' option on session cookies

This was an outcome of the penetration test.

Setting this tells the browser that the cookie should only be sent over HTTPS:
http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

Code inspired by: https://github.com/alphagov/whitehall/blob/master/config/initializers/session_store.rb#L3-L4