APP-114 session cookies should be marked secure