Make session cookies more secure.

1. Our session cookies only need to be available to http, so
   mark them appropiately.

2. Send the cookie to the subpath for mediagoblin.

And instantiate a session manager on the app, once.

1 files changed, 6 insertions, 3 deletions

diff --git a/mediagoblin/tools/session.py b/mediagoblin/tools/session.py
index d452b851..64220ed9 100644
--- a/mediagoblin/tools/session.py
+++ b/mediagoblin/tools/session.py
@@ -58,10 +58,13 @@ class SessionManager(object):
         except itsdangerous.BadData:
             return Session()
 
-    def save_session_to_cookie(self, session, response):
+    def save_session_to_cookie(self, session, request, response):
         if not session.is_updated():
             return
         elif not session:
-            response.delete_cookie(self.cookie_name)
+            response.delete_cookie(self.cookie_name,
+                path=request.environ['SCRIPT_NAME'])
         else:
-            response.set_cookie(self.cookie_name, self.signer.dumps(session))
+            response.set_cookie(self.cookie_name, self.signer.dumps(session),
+                path=request.environ['SCRIPT_NAME'],
+                httponly=True)