In production with HTTP, secure cookies are rejected by browsers. Allow HTTP until behind proper HTTPS proxy.