adds HttpOnly and Secure flags to the login cookie

This should close out #222.
Heh, just realized I had a slightly different approach to this. 

Setting HttpOnly makes sense and shouldn't kill anyone's http dev work. 
We can also seriously cheat here and do

    session.Options.Secure = !config.GetFlag("auth.use_insecure_cookie")

this will only default to Options.Secure being set, except if the user has specified the flag true in the config.