Use express trust proxy option instead of buggy secureProxy flag
Use custom cookie-session with proxy setting fixed