document using module loaders - closes #29
make cookie secure - closes #28