Prevent client code from reading our client cookie.

Prevent client code from reading our client cookie.

        * pom.xml: Use a later javax.servlet version than we seem to
get automatically, probably via GWT, so we have the
Cookie.setSecure() method, though I cannot find out when it
was added.
        * src/main/java/org/glom/web/server/OnlineGlomLoginServlet.java:
        checkAuthentication(): Call setSecure() on the Cookie, so it
can only be retrieved via HTTP(S), not by client code,
making it harder for Javascript to hijack the session.