Don't set cookie over HTTP if secure cookie is on

This fixes #338, but I'm not sold on the solution. I feel
like burdening Session with the HTTPS stuff breaks it's single
responsibility (it sets the cookie. period).

I'm going to try a second approach in another PR for comparison.