do not set Secure cookies on plain HTTP

closes #12