sanitize locale param, make cookies  secure