Local Tomcat Server with https CorsHandler returns secure JSESSIONID cookie but blocks insecure JTENANTSESSIONID_dev cookie

Question

I have Local Tomcat Server setup with https CorsHandler url. The tomcat server returns secure JSESSIONID cookie with the following web.xml config.