Use a secure session cookie for new installs

Turning `secure_cookie` on has the effect of making the cookie HTTPS-only, and
thus not susceptible to session hijacking. For security, this should be the
default in environments other than development and test.

The default initializer has been updated to reflect this. In Clearance 2.0,
this may become the default behavior in Clearance internals and thus no longer
depend on the initializer being present and containing the proper setting.
current_user also seems like a likely candidate for a method that's been overridden.

I'm not sure there's much to be done about that in any case with Clearance's setup, but possibly pushing this to be more internal would help.