use secure cookies

rather than setting tokens as plain cookies