use secure cookies

rather than setting tokens as plain cookies
remove cookie_secret from single-user servers

pass encrypted cookies to Hub for verification
Merge pull request #82 from minrk/secure_cookie

use secure cookies