Only set secure cookies when protocol is https