adds HttpOnly and Secure flags to the login cookie

This should close out #222.
I've looked into it and yeah, setting Secure and HttpOnly should work. The UI uses no cookie data and will have it's own token nonce for CRS.