Made servlet session cookie HTTP-only. Still need to force "secure"