more restructuring and config format cleanup.  Allowed localhost override for access token and account cookie to be insecure for local development purposes only.  Production environments still require ssl and secure cookies for login requests and identity cookies.