options bug fixes; set https cookies on by default