Cookie scope

Forces Play Session cookie to be HTTP_ONLY and SECURE.

Session domain already has correct scope:

![screen shot 2014-10-27 at 16 56 01](https://cloud.githubusercontent.com/assets/5786189/4795292/4b059350-5dfb-11e4-905a-61886dab1be8.png)

Please can you explain what this does?  I don't doubt it's a good thing, but would like to understand what it does.