fixed: https redirects to http without saving sessionid in reason with security autentification.
added CSRF tokens