Secure flag - JavaScript Cookies

[Chizl]

So in JavaScript its written that we can use the ";secure" flag to set HTTPS only cookies. However, I'm not on SSL when I'm running debug locally and I find the cookie is still being written. Is this a bug or something I'm doing wrong?

var expDate = new Date();
expDate.setDate(expDate.getDate() + 365);
document.cookie = "mainFrameSize=" + 
            escape(document.getElementById("mainFrame").cols) + 
            ";expires=" + expDate.toGMTString() + ";secure";

Edit: Using IE 7 on WinXP