use secure cookies (see https://github.com/SAP/sailing-analytics/security/code-scanning/91)

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/LocaleInjectionFilter.java

@@ -58,6 +58,7 @@ public class LocaleInjectionFilter implements Filter {
                                     preferredLocale.toLanguageTag());
                             cookie.setMaxAge(-1);
                             cookie.setPath("/");
+                            cookie.setSecure(true);
                             resp.addCookie(cookie);
                         }
                     }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/UserManagementServiceImpl.java

@@ -381,6 +381,7 @@ public class UserManagementServiceImpl extends RemoteServiceServlet implements U
         final Cookie cookie = new Cookie(UserManagementConstants.LOCALE_COOKIE_NAME, "");
         cookie.setMaxAge(0);
         cookie.setPath("/");
+        cookie.setSecure(true);
         getThreadLocalResponse().addCookie(cookie);
         logger.info("Invalidated HTTP session");
         return new SuccessInfo(true, "Logged out.", /* redirectURL */ null, null);