Use long-lived ID token cookie.
No longer need SERVER_NAME in app config.
Added option to disable secure cookie flag for development/debugging.