How to flag session cookie as secure (https only) in tomcat 6

I have done a lot of googeling and could not find an answer. I have tried setting the following in the web.xml file in the war with no impact :

<session-config>
        <session-timeout>60</session-timeout>
        <cookie-config>
            <http-only>true</http-only>
            <secure>true</secure>
        </cookie-config>
    </session-config>

Adding useHttpOnly in the tomcat context.xml file works to restrict cookies to http only but I still need to make them secure.