Use of secure attribute in cookies

I see at [Line 191 of oauthproxy.go](https://github.com/bitly/google_auth_proxy/blob/1e29aa1c122fe01bb9436d7ffa6bdd17d5fb8357/oauthproxy.go#L191) the question is raised of whether to use secure cookies if the X-Scheme is https (set the proxy header in nginx).

While this may be a good idea in the long run, in the short term, would it be better to decrease the chance of MITM attacks and set default of secure until a dynamic solution is implemented?

I understand this would cause incompatibility with those using this over HTTP only, though if they are I assume they have a very good reason and would be able to manually build it with the flag not set?

*Would it be better to the increase the default security for the majority of deployments vs. compatibility in certain edge case uses.*