set secure and httponly flags on session cookie; the former because it's just the right (and only sensible) thing to do, the latter because for those few browsers that support it, it's not a bad idea