Allow cookie secure flag for localhost connection

[Chocobo1]

The localhost is 'potentially trustworthy' and RFC 6265 allows setting secure flag in this case.

https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.5 https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy