Added SECURE_ONLY option in session.inc allowing explicit switching off https only...