Force all access to the app over SSL, use Strict-Transport-Security, and...

... use secure cookies.