adds HttpOnly and Secure flags to the login cookie

This should close out #222.
@st3fan  Do we need to set the Secure and HttpOnly flags for all our cookies or just this one login?