add secure cookie support & session use secure cookie by default