update: add secure cookie and ctx.g