Defaulting to HTTPS is not enough to prevent cookie theft by man in the middle attacks, because a browser will still happily do HTTP connections. (They'll get redirected to HTTPS if you configure the server for HTTPS only, but that's only happening after the Cookie is already transmitted without encryption.)
Traditionally there is a "secure" flag for cookies. (I know little go, but from reading the docs it seems it can be set in http.Cookie with Secure = true, similarly to the httponly flag he's describing.)
However these days there's a better solution: Use HSTS, which enforces HTTPS connections after the first connection has been made. Even better is HSTS preloading, where your domain is added to a whitelist of HSTS domains within common browsers.