start a secure, httpOnly session