respect the secure flag of the cookie