updated README.md
more secure tls settings, separated session from csrf