Bug with secure cookie and not tls communication