Secure flag stripped when setting cookie

[vigie]

Foxy will remove the Secure cookie flag from a set-cookie header. There seems to be special logic in lib/util.js to handle a similar case for HttpOnly flag, but no such code for the Secure flag. As a result the set-cookie header arrives back at the browser with that particular flag missing.