Added cookie settings
always set httponly (there is no good reason not to); simplify httponly and expire flags
Merge pull request #34 from jehiah/secure_cookies_34

Use of secure attribute in cookies