enhanced session handling

- automatic renewal of session lifetime after new request
- http-only cookie
- namespaced sessionslot with htmlform-prefix