set secure flag on cookies

[lenazun]

Starchy says:

I spotted some sites that aren't setting the Secure flag on their cookies, mostly session cookies. This isn't a huge problems since we're setting HSTS and redirecting HTTP to HTTPS, but it's a best practice we should implement when possible.

democracy.io* Set-Cookie: XSRF-TOKEN=undefined; Path=/