Encourage use of a secure session cookie

Turning `secure_cookie` on has the effect of making the cookie
HTTPS-only, and thus not susceptible to session hijacking. For
security, this should be the default in environments other than
development and test.

The default initializer has been updated to reflect this. New
applications that run the generator will have `secure_cookie` enabled
in all but development and test environments.

If `secure_cookie` is accessed having previously been unconfigured, a
warning is raised encouraging the developer to enable `secure_cookie` or
at least explicitly set it to false, thus opting in to the insecure
behavior.

Additionally, a descriptive application error is raised if
`secure_cookie` is enabled and yet `current_user` is accessed in a
non-ssl request. This is an indicator that the developer has forgotten
to enable SSL in this environment. This should help to address the
confusion that might arise from the generated initializer applying a
different configuration between development and production. Without the
application error, the end user would simply have a signed out session.