Security settings

Review active sessions. Refresh credentials remain in secure HttpOnly cookies.