Cookie: use secure cookie only in production env

Make the use of secure cookie conditional on being in production
environment - as per comments in #11.