subdomain cookie fix
secured routes a little bit more