Update session cookie flags

Added "secure" and "httpOnly", also to cookie deletion requests