A.5.2.4 Cookie handling fixes

###
A.5.2.4 Cookie handling fixes

1. A Cookie path bug was noticed when Albatross applications were used with the Safari browser. `absolute_base_url()` was generating a trailing slash on the returned application URL (so /path/app.cgi/ instead of /path/app.cgi). This was causing problems for requests like /path/app.cgi?blah in that Safari did not send the cookie (probably correctly).

2. When an application was accessed via https, the `secure` attribute on any resulting cookies was not being set. This attribute marks the cookie to be only returned via an https connection. The `secure` attribute is now set.

3. Cookie max-age was being allowed to default - this is now explicitly set to match the configured session age (from the Application `session_age` parameter).