Sign the auth token cookie and make it httpOnly
Merge pull request #215 from tms/auth-token-changes

Sign the auth token cookie and make it httpOnly