Add secure cookie header to protect login state data

It looks like Quarkus handles cross node login states through storing token data in a secure HTTPOnly cookie. This change updates the flag to enforce secure even in HTTP calls.