I am using Tomcat in my production environment and jetty in my testing environment (via jetty-maven-plugin).
Tomcat sets the secure-flag on a jsessionid-cookie, when it
I am adding the following just to show the complete example that worked for me.
Put the following in WEB-INF/jetty-web.xml
true