mark the cookie as secure (it should only be sent over https)