Improve security of token by using secure http-only cookie

[brentmitchell25]

Checklist

• I have looked into the Readme and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

This repo still stores the JWT in the browser. A few modifications can be made to make it follow the BFF patern for more secure token use.

Describe the ideal solution

The secret store could set the token when the user logs in:

store.Options(sessions.Options{
  Path:     "/",
  HttpOnly: true,
  Secure:   true,
})

The logout will also need to clear the session as well:

// get session details (cookie)
authSession := sessions.Default(ctx)

// clear details (logout)
authSession.Clear()
authSession.Options(sessions.Options{
  MaxAge:   -1, // This instructs the browser to delete the cookie
  Path:     "/",
  HttpOnly: true,
  Secure:   true,
})

Alternatives and current workarounds

No response

Additional context

No response

[alokrajput77]

#95 (comment)