Dont use cookie for roles and require https for login