use secure cookies

rather than setting tokens as plain cookies
remove cookie_secret from single-user servers

pass encrypted cookies to Hub for verification
Merge pull request #82 from minrk/secure_cookie

use secure cookies
database security

- add files for cookie and database secrets
- store cookie secret on disk, instead of in database
- encrypt auth tokens with EncryptedType