A cookie is stored on the client, and sent to the server when the "conditions are right" (in particular, cookies are associated with a server, and are sent back to that server only). A cookie marked secure is a cookie which will be sent to the server only when the connection is "secure" (i.e. SSL, aka "HTTPS").
The contents of the cookie are under control of the server: the browser will store in the cookie only what the server tells him to store. Marking a cookie as "secure" makes sense if the contents of the cookie are sensitive in some way (they are confidential, or should not allow external alterations, or, more often, both at the same time). If the cookie contents are sensitive, then they should never be sent over plain HTTP; not when the cookie is sent back to the server (the "secure" flag is about instructing the browser not to commit that specific blunder), but also not when the cookie is initially created.
In short words, if the server is sending, over plain HTTP, a cookie for storage in the client with the "secure" flag, then something is wrong.
In even shorter words: you need site-wide HTTPS. Partial HTTPS is difficult to get right (to some extent, it is mathematically impossible to get right).