Some additional information that I forgot to mention in the original post:
The session cookie is set with CGI::Session not with CGI::Cookie. I can't seem to find anywhere in the documentation on how to set the session's secure flag to true. Is this possible?