Cookie fix: don't set to secure when ssl config is false.