More secure session and cookies
* set cookies to HTTP only
* set secure flag on cookies (don't forget to comment this line in dev mode!)