alphagov/transition — pull request #110 by jamiecobbett (2013-12-09 11:12:00+00:00)
Title: Set the 'secure' option on session cookies

This was an outcome of the penetration test.

Setting this tells the browser that the cookie should only be sent over HTTPS:
http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly