enable secure cookie if using https and prevent cookie access from js

Those cookie options were enabled only if using a HTTPS proxy.

Also add some logging info to the Auth helper.