force secure cookies in production