Update sessions to be secure, httponly and using encrypted cookies