Setting session cookie to HTTP only.
Merge branch 'secure_sessions' into dev