def flag_cookies_as_secure!(headers)
      if cookies = headers['Set-Cookie']
        # Support Rails 2.3 / Rack 1.1 arrays as headers
        unless cookies.is_a?(Array)
          cookies = cookies.split("\n")
        end

        headers['Set-Cookie'] = cookies.map do |cookie|
          cookie !~ /(^|;\s)secure($|;)/ ? "#{cookie}; secure" : cookie
        end.join("\n")
      end
    end
def flag_cookies_as_secure!(headers)
      if cookies = headers['Set-Cookie']
        # Support Rails 2.3 / Rack 1.1 arrays as headers
        unless cookies.is_a?(Array)
          cookies = cookies.split("\n")
        end

        headers['Set-Cookie'] = cookies.map do |cookie|
          cookie !~ /(^|;\s)secure($|;)/ ? "#{cookie}; secure" : cookie
        end.join("\n")
      end
    end
see http://en.wikipedia.org/wiki/HTTP_cookie#Cookie_theft_and_session_hijacking