Sign the auth token cookie and make it httpOnly

Since this seems to be a non-expiring value, eliminating the potential to make a lucky guess and protecting the cookie from XSS sniffing seems like the best call.