force api routes to use https, allow sharing of cookies between subdomains