Set the Secure flag on cookies

[strugee]

See https://github.com/expressjs/session's secure option.

[strugee]

Tracking as semver-major because reverse proxy users might have to change a config setting in order for us to enable this by default.