Security improvement: make tkt cookie HTTP only