fixes #35: improve security; handle cookie values
fixes #35: move loader.config to config.js
update description; update README.md