removed ssl req for cookies