adding warden
explicitly no SSL on cookies