I don't understand what you're talking about. My entire site is HTTPS, I also use Strict-Transport-Security, have a ruleset in HTTPS-Everywhere, and I don't use cookies at all. If I were to use cookies, I'd make sure to add the secure and httpOnly flags.

Me putting a redirect on http to https is no less secure than not providing http at all.