Optionally set 'secure' flag on response cookies automatically, closes #899