add more cookie settings (for now with defaults)
logging: make sure ERRORs also go to stderr for the request logging handler

otherwise tracebacks just vanish (if you do not see them in the browser or in your email)