Cookie scope

Forces Play Session cookie to be HTTP_ONLY and SECURE.

Session domain already has correct scope:

![screen shot 2014-10-27 at 16 56 01](https://cloud.githubusercontent.com/assets/5786189/4795292/4b059350-5dfb-11e4-905a-61886dab1be8.png)

I think it's fine to have the default value 'local' bucket in here because it means devs do not need to run the deploy scripts for local running & testing.