use secure cookies

rather than setting tokens as plaintext cookies

and don't tell the single-user server about the Hub's cookie secret