set secure flag on cookies when connecting via https
login return address is https only
set Strict-Transport-Security header for https
add httpsonly flag
allow zero in config