resolved it.
found this ticket:
https://github.com/auth0/passport-auth0/issues/70
and a question on stackoverflow:
which explain some things about state values, heroku and SSL ans well as how to resolve the problem
specifically i changed:
if (app.get(‘env’) === ‘production’) {
sess.cookie.secure = true; // serve secure cookies, requires https
}
to
if (app.get('env') === 'production') {
app.set('trust proxy', 1); // trust first proxy
sess.cookie.secure = true; // serve secure cookies, requires https
}
you could also leave all of the above out if you don’t want to use secure cookies.
hope this helps other