And now when u created a new session, those have secure flag as false (since u set secure to false in config). And those go with http://localhost