Fix express sessionCookie proxy setting

Also make sure secure cookie is not enforced in dev environment
[fixes #168]