Use a secure session cookie for new installs

Turning `secure_cookie` on has the effect of making the cookie HTTPS-only, and
thus not susceptible to session hijacking. For security, this should be the
default in environments other than development and test.

The default initializer has been updated to reflect this. In Clearance 2.0,
this may become the default behavior in Clearance internals and thus no longer
depend on the initializer being present and containing the proper setting.
In cases where it's overridden it should still be calling `super` otherwise you're on your own anyway.