removed GET from proxy
set secure cookie in production