Improve application security

#### Improve application security:

- Make session cookies only available via HTTP (prevent access from JavaScript)
- only log PHP errors instead of displaying them in production.
  Displaying errors may give attackers hints how to exploit the application

#### Set HTTP headers:

**X-Frame-Options: DENY**
Prevent Clickjacking attacks, see: http://en.wikipedia.org/wiki/Clickjacking

**X-Content-Type-Options: nosniff**
Prevent code injection via mime type sniffing