LEAF_SECURE_COOKIE is unintuitive

[wezm]

See if there's a way to get rid of needing to know about LEAF_SECURE_COOKIE in the common case. E.g. in development set it to false and production set it to true. See #8