Don't require HTTPS for cookies

This makes testing easier by not requiring HTTPS for testing.

In production mode, the application should block HTTP anyway for security reasons. If the application only runs in HTTPS, this setting becomes redundant.