Secure cookie issue

I'm using koa-session for a login service and found a problem when login from http://localhost.

Front-end app using http-proxy with the config like this
```
{
"/api", {
target: "https://test.com",
changeOrigin: true
}
}
```
so when the app is running at localhost:3000, it can sent ajax request to https://test.com
but the problem is when login service send the response header with the `set-cookie`, the cookie has the `secure` option (I think probably detect that request is from https because the `changeOrigin` is set to true). And since i'm using http://localhost, the cookie is not saved (or send), so login is failed.

Currently I manually set `secure: false` in the config, is there a better way of fixing this?

Start by reviewing koa-session's handling of the request protocol and secure cookies when requests pass through the shown http-proxy configuration. Reproduce the localhost login flow and inspect the Set-Cookie response and subsequent requests. Done means the intended cookie behavior is verified for this proxy setup without requiring the reported manual configuration workaround.

Written by the indexing model from the issue text.