deprecate HttpSessionSecurityCookieFilter

This fixes #484

HttpSessionSecurityCookieFilter duplicates the JSESSIONID in another cookie, one that can't be marked 'Htt
pOnly'. That means in an XSS attack the attacker could read the JSESSIONID and hijack the session.

Instead we should use RandomSecurityCookieFilter which doesn't have this issue (since it doesn't duplicate the JSESSIONID).
remove extra whitespace

Removing trailing whitespace that broke the build.
Merge pull request #486 from bradcupit/master

deprecate HttpSessionSecurityCookieFilter