Secure session

Tokens are set through a server proxy route as HTTP-only cookies, never local storage.