Corrected setting of cookieSecure based on protocol