Fix large file uploads by making upload size writable.
Only store user_id, not user object, in the session hash (#79).
Set cookie expiry and secrets (#79).