I could be misunderstanding, but is that not what the secure cookie flag is for?