fix handling of secure cookies