Removed secure flag from csrf-token cookie and added httpOnly