Make session cookie HTTP-only and secure (transmit only over SSL).