credential-containing cookies should be set as secure.