adds HttpOnly and Secure flags to the login cookie

This should close out #222.
For all cookies would be good. There is nothing that is non-SSL right? As for HttpOnly, I have not actually checked if the web frontend requires access to the cookies. I doubt it does as the cookies are encrypted server-side.