fix(18): swap Secure directive for cookies when forwarding from HTTPS to HTTP