Secure cookie

Flips the secure flag on for session cookies. Can one you's guys (@novotnyjakub or @threedaymonk) eyeball quickly and merge please?
It's not strictly the same, because if `ENV['SECURE_COOKIES']` is `bla`, then it'll still evaluates as true..