refactor sendRequest to pass in route instead of route.type and secured.  allows only setting cookies on ctx when processing primary route