Optionally set 'secure' flag on response cookies automatically, closes #982
merge 1e02f7aef9e798b406edcba977822248d90dff07, refs #982