ussing session cookies and make secure