default to not using secure cookies