Optionally set 'secure' flag on session cookies automatically, closes #981
merge 90ffbb20c6dfe03ab7e37608dfefb514eed861da, refs #981