add api to add/get secure cookie; use secure cookie to do the xsrf valid...

Changes:

1. Add GetSecureCookie and SetSecureCookie to context/context.go
2. Change the _xsrf validation to use the secured cookie

Tested pass on our environment.