use secure cookies for Arcor where possible