Optionally set 'secure' flag on response cookies automatically, closes #899
merge [3563/branches/0.11], refs #899