Add config option 'insecure_cookies'.

When developing, it is convenient to use HTTP instead of HTTPS. The use
of HTTP Cookie secure=True must then be disabled, otherwise at least
Chrome will not set a cookie.

The default is naturally to NOT produce insecure cookies.