Cookie scope

Forces Play Session cookie to be HTTP_ONLY and SECURE.

Session domain already has correct scope:

![screen shot 2014-10-27 at 16 56 01](https://cloud.githubusercontent.com/assets/5786189/4795292/4b059350-5dfb-11e4-905a-61886dab1be8.png)