oidc.go: Set cookie to Secure when prod=true