forced HttpOnly flag to true all the time
changed Secure flag to use !auth.use_insecure_cookie