Allow excluding cookies with a proc

Allow setting non-secure cookies so that other websites under the same TLD using plain HTTP can access it.

Adds option `exclude_cookie` which is a proc called with the cookie name, and returns true if the cookie can be allowed over plain HTTP connections.