thoughtbot/clearance — pull request #347 by derekprior (2013-08-23 18:30:33+00:00)
Title: Don't set cookie over HTTP if secure cookie is on

This fixes #338, but I'm not sold on the solution. I feel
like burdening Session with the HTTPS stuff breaks it's single
responsibility (it sets the cookie. period).

I'm going to try a second approach in another PR for comparison.