add secure attribute option of _xsrf cookie

settings = dict(cookie_secret="foooooooooooooooooooooooooooooo",
                static_path=os.path.join(os.path.dirname(__file__), "static"),
                template_path=os.path.join(os.path.dirname(__file__), "templates"),
                login_url="/admin/login",
                xsrf_cookies=True,
                xsrf_cookie_secure=True,
                autoescape="xhtml_escape",
                debug=True,
                )