Secure repoze.who auth cookie

The `secure` flag can be set from the config file with `who.secure = True`.

This is related to issue #1942. This is branched from the branch used by PR #2050, so it may be easier to review and merge that before this one.