People could use the HTTPS-Everywhere Firefox addon. HTTPS-Everywhere rulesets can also be configured to add the secure flag to cookies. The main Facebook ruleset doesn't do that because certain pages can't be accessed via HTTPS on Facebook still, however there is a second ruleset disabled by default which you can enable which adds the secure flag and breaks a few unimportant pages.