Juan Lang : wininet: Secure flag is set in the request, not in the session.