refractor cookies - cookies now secured by default