before my connect.sess was http only. now it's also secure. make sure xsrf-token cookie is secure as well