cookie only sends when req.secure is true + force ssl, test on server now