ugh yeah there's some weirdness here. I think we need to do this for the case where we have an http to https rule for foo.example.com and example.com (but not *.example.com) and a securecookie rule for host="^\.?example\.com". In that case, we're not forcing SSL on bar.example.com, so cookies for example.com could get sent over clear HTTP to bar.example.com before we've independently set the secure flag.