I've just found these two superb settings in the Internet Site doc...
Restrict use of single server session cookie to HTTP/HTTPS: Require SSL protected communication HTTPS for single server session cookie:
They are great as they allow you to have the
DomAuthSessID set to secure, thus massively increasing domino's security over the web.
The question is when where they added or is there any help for them? I can't find any mention of the options in the Admin help or release notes. I can't see them in Domino 8.5 so must have been added in 9 at some point. There were similar settings for SSO/LTPA cookies before which were also exposed as Notes.ini settings but not previously for single server