minor fixes
- add missing cookieParser secret
- profile: server-side login redirect, client-side redirect after login
- auctions are tracked by _id - see ngRepeat docs