fix cookieSecure flag; fix from @alexanderdean