Make session cookie HTTP-only and secure (transmit only over SSL).
Merge pull request #4 from SURFnet/maintenance/session-cookies

Make session cookie HTTP-only and secure (transmit only over SSL).