add setting to use secure cookies