Fix cookie-session options.

Only use secureProxy when in production.