Various top-level changes: add comments, remove log statements, bump version, add redirect target validation, add session secret, add secure cookie flag