Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.