Set cookie via standard scheme, not based on is_ssl().  Fixes #837.