Fix secure handling in setGlobalCookies

If null is passed for $secure, we need to use $wgCookieSecure to
determine whether to set forceHTTPS.

Also, pull the user's prefershttps preference if we don't already have
it in memcached.

Change-Id: Ia846c1b20f816a209cfb77f06ad7bbc7f1eb3e13