Secure cookie

Flips the secure flag on for session cookies. Can one you's guys (@novotnyjakub or @threedaymonk) eyeball quickly and merge please?
I *think* that's what @threedaymonk meant when he said it "fails safe".