Issue 4840 secure flag on cookies