don't use secure cookies for the moment