Add missing middleware and cookieSecret

/to @raymondfeng 

This depends on:

 - https://github.com/strongloop/loopback/pull/96
 - https://github.com/strongloop/loopback/pull/97