In a Rails controller, I can set a cookie like this:
cookies[:foo] = \"bar\"
And specify that the \"secure\" (https-only) flag be on like this:
# session only available over HTTPS ActionController::Base.session_options[:secure] = true