session cookie is now http only and secure if not in developer mode