Add options to secure cookies (and sane defaults).
Remove branding from package.json and add some more information.
Add CSRF protection.