made my xsrf-token cookie secure, but not httponly. that causes angular to not get the cookie = bad.  played around with it, seems to work. weird error about a forbidden post request for if req.secure is not true earlier, then couldnt replicate it