added /token endpoint to wrangle app access tokens, updated session cookies and secure cookie handling