Ensure cookies have httponly and secure flags set
Tweak database fields for consistency in length
Encode various JavaScript URL components
Fix issue with environment key on configuration file update
Add option to disable password recovery