make cookie secure only in production