Support Flask-Login cookie security settings

[stanhu]

Issue Summary

A security audit showed that the cookie settings on the Flask-Login remember_token didn't have the HttpOnly and Secure flag set. Redash uses Flask-Login, but there doesn't appear to be a way to pass along the REMEMBER_ settings: https://flask-login.readthedocs.io/en/latest#cookie-settings

Steps to Reproduce

1. Enable HTTPS.
2. Login to Redash.
3. Inspect the cookies.

The HTTP-only and Secure flag are not set.

Technical details:

Here is the hack we added to the source code:

root@redash:/opt/redash/current/redash/authentication# diff __init__.py.orig __init__.py
143a144
>     app.config.update(REMEMBER_COOKIE_SECURE = True, REMEMBER_COOKIE_HTTPONLY = True)