Made servlet session cookie HTTP-only. Still need to force "secure"
Merge branch '2.1final' into qa