fix
secure flag of sptoken cookie can be disabled on devel envs