Use How view before authorising if not authorised
Use an encrypted session cookie
Suppress Rack security warning when running specs