Optionally set 'secure' flag on session cookies automatically, closes #898