Switch to secure cookies (HTTPS only)

[redrun45]

One more while we're at it! 🚀

[notartom]

According to [1], cookie_secure determines "whether to create the session cookie only on encrypted (HTTPS) connections." Since we have only HTTPS, with our HTTP site redirecting to HTTPS, this is kind of a noop? Doesn't harm things, though.

[redrun45]

Not sure why it isn't mentioned, but cookie_secure also sets the Secure flag within the cookie, so that the browser won't send it back to the server over HTTP.
It really should be a no-op, but some browsers might drop their 301 redirect cache before the cookie expires. 🤷

In any event, thanks! I'll have a pair of patches headed your way soon-ish. 😉