fix: transmit cookies securely

.env.example

@@ -1,2 +1,3 @@
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/postgres
-SECRET=
+SECRET=
+ENVIRONMENT=

src/server/server.ts

@@ -27,7 +27,11 @@ server.set('trust proxy', 1);
 server.use(
   session({
     secret: process.env.SECRET,
-    name: 'sessionId'
+    name: 'sessionId',
+    cookie: {
+      secure: process.env.ENVIRONMENT !== 'dev',
+      httpOnly: true
+    }
   })
 );
 server.use(limiter);