switch session secure to false