force SSL (and secure cookies) on webui

Fixes opscode/chef#1759.

Setting `force_ssl` to true forces SSL (which was not previously an issue, since nginx is already serving everything as SSL) and sets the "secure" flag on cookies, which was missing.