Only set secure cookies when protocol is https

See issue #44