Fix cookie propagation from HTTP to HTTPS, close #899