How to instruct Phoenix to set secure flag (HTTPS only) on session cookie?

This isn’t default? It really should be default! It’s not like it’s useful to javascript anyway considering it is encoded… ^.^;