SD-75: Address ZAP report issues to Improve Cookie Security

[agraham19]

Addresses a few issues raised by an automated security scan:

• add sameSite: 'strict' attribute to session cookie
• disable caching
• set session cookie to httpOnly (prevents browser js reading it)

[robertdeniszczyc2]

Confirming my comment has been addressed