cookie.secure needs to be false for csrf to work