use secure (ssl-only) cookies