Add Secure cookie flag option to session cookie

[Tratcher]

The session cookie needs the ability to have the 'Secure' flag set.

This depends on aspnet/HttpAbstractions#612.

Note we considered doing this in the past (#28), but we considered the Microsoft.AspNetCore.CookiePolicy middleware to be adequate. That's no longer the case because we want to apply token binding data protection based on if the cookie will be marked as Secure.

[joerter]

Will this be included in the 1.1.0 release?

[Tratcher]

Yes

[sewarts]

Using 1.1. but there is no options.Cookie.SecurePolicy = CookieSecurePolicy.Always option

[Tratcher]

In 1.1 it's options.CookieSecure

Session/src/Microsoft.AspNetCore.Session/SessionOptions.cs

Line 42 in f8b38c9

public CookieSecurePolicy CookieSecure { get; set; } = CookieSecurePolicy.None;