fix secure attribute in server.xml