Fix for #1 "Credentials object should not be stored in a cookie"

...of a cookie. Flask stores session data in cookies, which is insecure because the credentials object contains information including the application's client secret.