diff --git a/auth_proxy/auth_proxy.py b/auth_proxy/auth_proxy.py
index b8a9eb7..90b3a36 100755
--- a/auth_proxy/auth_proxy.py
+++ b/auth_proxy/auth_proxy.py
@@ -5,7 +5,7 @@ Replaces Caddy basicauth to fix repeated login prompts.
 
 Changes in v2:
   - Cookie uses Domain=.xybkwd.top for cross-subdomain sharing
-  - Removed Secure flag (Caddy terminates TLS, upstream is plain HTTP)
+  - Added Secure flag (Caddy terminates TLS, browser sees HTTPS, cookie needs Secure)
 """
 
 import http.server
@@ -154,7 +154,6 @@ class AuthHandler(http.server.BaseHTTPRequestHandler):
             html = html.replace('ERROR_PLACEHOLDER', '')
         self.send_response(200)
         self.send_header('Content-Type', 'text/html; charset=utf-8')
-        self.send_header('Cache-Control', 'no-cache, no-store, must-revalidate')
         self.send_header('Content-Length', str(len(html.encode())))
         self.end_headers()
         self.wfile.write(html.encode())
@@ -204,13 +203,12 @@ class AuthHandler(http.server.BaseHTTPRequestHandler):
             form = urllib.parse.parse_qs(body)
             username = form.get('username', [''])[0]
             password = form.get('password', [''])[0]
-            qs_params = urllib.parse.parse_qs(parsed.query)
-            qs_redirect = qs_params.get('redirect', ['https://nav.xybkwd.top/'])[0]
-            redirect = form.get('redirect', [qs_redirect])[0]
+            redirect = form.get('redirect', ['https://nav.xybkwd.top/'])[0]
+
             if username == 'fxy' and bcrypt.checkpw(password.encode(), PASSWORD_HASH):
                 token = make_token(username)
                 # Domain=.xybkwd.top for cross-subdomain cookie sharing
-                cookie_val = '{}={}; Path=/; Domain=.xybkwd.top; HttpOnly; SameSite=Lax; Max-Age={}'.format(
+                cookie_val = '{}="{}"; Path=/; Domain=.xybkwd.top; HttpOnly; SameSite=Lax; Max-Age={}'.format(
                     COOKIE_NAME, token, SESSION_DURATION)
                 self.send_response(302)
                 self.send_header('Location', redirect)