Secure Cookie dev env switch

Set express cookie.secure to be true by default.

If the NODE_ENV is set to 'development' then cookie.secure is set to
false.