make secure cookies configurable