diff --git a/config.py b/config.py
index c0b8a51..0018e3b 100644
--- a/config.py
+++ b/config.py
@@ -5,14 +5,14 @@ class Settings(BaseSettings):
     port: int = 5000
     db_url: str
     fernet_key: str
-    cookie_httponly: bool = False
+    cookie_httponly: bool = True
     frontend_url: str
     boss_url: str
     boss_aes_key: str
     boss_hmac_key: str
     
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
-    cookie_secure: bool = False
+    cookie_secure: bool = True
 
 settings = Settings()
 cipher = Fernet(settings.fernet_key.encode())
\ No newline at end of file
diff --git a/database.py b/database.py
index 9629bd6..50fa64f 100644
--- a/database.py
+++ b/database.py
@@ -23,6 +23,7 @@ class Session(Base):
 engine = create_engine(settings.db_url, pool_pre_ping=True)
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
+# TODO: look into why this is being called twice on startup
 def init_db():
     try:
         Base.metadata.create_all(bind=engine)
@@ -34,4 +35,4 @@ def init_db():
         print(f"database setup error: {str(e)}")
         raise
 
-init_db()
+init_db()
\ No newline at end of file
diff --git a/main.py b/main.py
index a7b2b20..347db40 100644
--- a/main.py
+++ b/main.py
@@ -10,17 +10,6 @@ from services.boss_retrieval import process_boss_file
 from contextlib import asynccontextmanager
 import asyncio
 
-app = FastAPI()
-
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=[settings.frontend_url], 
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-    expose_headers=["Set-Cookie"],
-)
-
 async def boss_worker_loop():
     print("background worker started")
     while True:
@@ -29,10 +18,6 @@ async def boss_worker_loop():
             process_boss_file()
         except Exception as e:
             print(f"worker error: {e}")
-        
-        # TODO: actually sync to what schedule says.
-        # for now its set to 1hr just incase pretendo fuckery happens
-        # (such as rotation ending)
         await asyncio.sleep(3600)
 
 @asynccontextmanager
@@ -44,6 +29,15 @@ async def lifespan(app: FastAPI):
 
 app = FastAPI(lifespan=lifespan)
 
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[settings.frontend_url], 
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+    expose_headers=["Set-Cookie"],
+)
+
 @app.middleware("http")
 async def force_cors_on_errors(request: Request, call_next):
     response = await call_next(request)
diff --git a/routes/sso.py b/routes/sso.py
index de1f426..73ec5dc 100644
--- a/routes/sso.py
+++ b/routes/sso.py
@@ -83,8 +83,8 @@ async def login(
             key="session_id",
             value=active_session.id,
             httponly=settings.cookie_httponly,
-            secure=False,
-            samesite="lax",
+            secure=settings.cookie_secure,
+            samesite="none",
             path="/",
             max_age=cookie_age,
             domain=None