Mention change of cookie name when used over https in README.config

[jw35]

RAVEN058 in master TODO list

[jw35]

The module uses a cookie called ucam_webauth_session over http, and one called ucam_webauth_session_s over https (with secure=true). This is essentially necessary to allow Ucam WebAuth authentication over http and https without exposing the cookie used over https. However this behaviour isn't documented.