Check for truthiness of $_SERVER['HTTPS'] when setting auth cookie.

This key might be set but false, so just checking whether it's set
isn't quite sufficient.