Secure cookie

Flips the secure flag on for session cookies. Can one you's guys (@novotnyjakub or @threedaymonk) eyeball quickly and merge please?
How about this (simpler and fails safe) instead?

```ruby
secure_cookie = ENV['SECURE_COOKIES'] != 'false'
```