Default to sending only for HTTPS in production

but not for development and test.
Merge pull request #140 from fernandoacorreia/secureCookie

Don't require HTTPS for cookies