You disable security cookie but set server.ssl.enabled to true.
server.ssl.enabled
Could you share your config.yml?