cookie hash sha256, ssl only