Add robots.txt file
Disable httpOnly for session cookies

This will allow the signed session cookie to be read by JavaScript in
the browser.