Secure Sessions

Authentication breaks when `session.secure: true;`.

Possible solution: set `trust proxy` to `true`.

```
if (app.get('env') === 'production') {
  app.set('trust proxy', 1) // trust first proxy
  sess.cookie.secure = true // serve secure cookies
}
```

https://github.com/expressjs/session