adds HttpOnly and Secure flags to the login cookie

This should close out #222.