wip
Use secure cookies only in prod