Use a secure session cookie for new installs

Turning `secure_cookie` on has the effect of making the cookie HTTPS-only, and
thus not susceptible to session hijacking. For security, this should be the
default in environments other than development and test.

The default initializer has been updated to reflect this. In Clearance 2.0,
this may become the default behavior in Clearance internals and thus no longer
depend on the initializer being present and containing the proper setting.
It may make more sense to do this on, say, `authenticate`. I can think of valid reasons where you may have `secure_cookie` enabled, be on a non-ssl connection, and still call `current_user` expecting it to return `nil` or `guest` in those cases.

This is probably not the right place for this error.