enable secure cookie if using https and prevent cookie access from js

Those cookie options were enabled only if using a HTTPS proxy.
Merge pull request #578 from niol/auth-fixes

enable secure cookie if using https and prevent cookie access from js