fix cannot run when base url contains a ~ (Fix #576)

This patch was cherry picked from f3 upstream.

https://github.com/bcosca/fatfree/commit/690566cc38d9c76dee35a99d05dde04adcd5daa2
fix cannot login when not using HTTPS (fix #581)

Auth refactoring uncovered a bug in $cookie_secure boolean evaluation.

Thanks @PhrozenByte for spotting !