client side cookoes are already inherently unsafe. on the server, the chance that your cookie is for auth is high, so make a secure cookie the defaul. force ht

client side cookoes are already inherently unsafe. on the server, the chance that your cookie is for auth is high, so make a secure cookie the defaul. force http headers that say server only, etc. Then allow for the security to be dropped via the extra arguments, not the other way around.