Fix httpOnly option
Add Util#safeURI
Add Session(Provider)

- Eliminate User