Use an `httpOnly` cookie

[mwildehahn]

• Would need to change the apollo client on the client side to no longer read from a cookie and use withCredentails.
• Would also need to have middleware before postgraphile which auto-adds the authJWT cookie value if present as the authorization header so postgraphile can look it up: https://github.com/postgraphql/postgraphql/blob/273ae4b0ae40d50bcc6c2874711ced3beb683aa0/src/postgraphql/http/createPostGraphQLHttpRequestHandler.js#L401