central: cookie domain and secure set by flag