SessionManager: Abstract forceHTTPS cookie setting