APP-116 ensure session cookies are HttpOnly
APP-112 added support for rekeying a session
APP-114 session cookies should be marked secure
fixed typo