prose/prose — pull request #264 by gmaclennan (2012-11-29 23:51:04+00:00)
Title: Stop github oauth token from being sent over insecure connections

At the moment Prose.io sends a cookie containing the github oauth token over unencrypted HTTP requests to http://prose.io. This leaves it vulnerable to [session hijacking](http://en.wikipedia.org/wiki/Session_hijacking). Since this cookie is only used to store the token for AJAX requests to the github servers (over https) there is no need for this to be sent on HTTP requests to http://prose.io

This commit simply adds `secure: true` to the cookie when it is created to ensure that it is not sent over http requests.