changed JSESSIONID cockie's security behavior to be used in http and https