Warn users logging in over http when session.secure = true

Fixes #40