The secure flag was not set on session cookie. Fixed.