deprecate HttpSessionSecurityCookieFilter

This fixes #484

HttpSessionSecurityCookieFilter duplicates the JSESSIONID in another cookie, one that can't be marked 'HttpOnly'. That means in an XSS attack the attacker could read the JSESSIONID and hijack the session.

Instead we should use RandomSecurityCookieFilter which doesn't have this issue (since it doesn't duplicate the JSESSIONID).