add cookie settings to config (by default: use a session cookie and only do it via https)