switched back to render_secure to require cookies