enable secure cookie if using https and prevent cookie access from js

Those cookie options were enabled only if using a HTTPS proxy.