Security changes from Cigital (Coke)

Addresses the following:

COKE-1887 - CMS Security Issue: Default Role is Admin for new users (brightspot 2.0)
COKE-1888 - CMS Security Issue: Secure/HTTPOnly Flags not set in Cookies (Brightspot 2.0)
COKE-1889 - CMS Security Issue: Do not allow CMS to be iframed
COKE-1890 - CMS Security Fix: Must confirm current password before changing password