A bug was introduced in release 9.9.0 (commit 9a69930)

Configuring your web server with HTTPS is not an issue, but if using HTTP, the session cookie secure attribute was forced to true.

Solution

Set the session cookie secure attribute to true only while using HTTPS

Relates #255

Thanks again to @fxrb for raising this.