Customer cookie should be set without https

So that the cookie is available on sites where some pages are HTTP and others are HTTPS.

REsolves #837