Always use secure sessions, no need to restrict this to production only.