Session-Cookie cannot be set to secure

**Describe the bug**
There is no way of setting a session to secure.

**To Reproduce**
1. Enable sessions, set samesite to `Lax` or anything other than `None`
2. Start the app and use curl or the browser to send a request
3. Look at the `Set-Cookie` header

**Expected behavior**
That a session cookie is by default, or can be set, to have the `Secure` attribute.