title: Local Tomcat Server with https CorsHandler returns secure JSESSIONID cookie but blocks insecure JTENANTSESSIONID_dev cookie
body: <p>I have Local Tomcat Server setup with https CorsHandler url.
  The tomcat server returns secure JSESSIONID cookie with the following web.xml config.</p>
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;10&lt;/session-timeout&gt;
      &lt;cookie-config&gt;
          &lt;http-only&gt;true&lt;/http-only&gt;
          &lt;secure&gt;true&lt;/secure&gt;
          &lt;max-age&gt;10800&lt;/max-age&gt; 
      &lt;/cookie-config&gt;
      &lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;
    &lt;/session-config&gt;
  </code></pre>
  <p>There is one more cookie being set by NEO JAVA SDK in file tenant_session_cookie.properties.
  The properties are defined below:</p>
  <pre><code>cookie_name_prefix=JTENANTSESSIONID_??
  secure=true
  http_only=true
  </code></pre>
  <p>This cookie is returned with HttpOnly attribute but <strong>does not have Secure</strong> attribute which causes my app to block cookie for browser.
  How can i set all cookies to secure through configuration without adding any extra code?</p>