add api to add/get secure cookie; use secure cookie to do the xsrf validation