Session fixation and session expiration added. HttpOnly tag also added to the session cookie