Change cookie when hosted on heroku

When we officially publish this on heroku, we'll need to change the cookie in router.js as at the moment this is set to http only.

[joeylouise]

Might not have to change this, httpOnly should probably only be true...?

https://www.owasp.org/index.php/HttpOnly

https://security.stackexchange.com/questions/157133/is-a-secure-cookie-without-the-httponly-flag-a-problem