Fix session.cookie.secure in prod mode