Elevated security mostly works. Needs some cleanup and domain on cookie