Fixed Formatting Issue

Go will refuse to compile unless the last key is on the same line as the closing brace:

`non-declaration statement outside function body`.

Additionally, I set the HttpOnly flag on. I think this is a good default for everybody as it increases security and Gorilla's cookies are actually encrypted so JavaScript access is unlikely to be needed.