made cookie secure and http only