security: Secure cookie flag (ANIWEB_SECURE, on in run.sh) + kill sessions of deleted accounts

- middleware re-verifies the username against users.json per request:
  deleted accounts' signed cookies are rejected immediately
- set_cookie/delete_cookie honor the Secure flag; run.sh sets
  ANIWEB_SECURE=1 so sessions only work through the HTTPS proxy

tests/test_api.py

@@ -119,6 +119,8 @@ def test_self_delete(base=BASE):
     jar = login("dave", "davepw12345", base)
     assert req("POST", "/account/delete", jar=jar, base=base) == 200
     assert "dave" not in json.load(open(_users_file()))
+    # old session cookie is dead immediately (middleware re-checks existence)
+    assert req("GET", "/api/me", jar=jar, base=base) == 401
     jar2 = CJ()
     assert req("POST", "/login", {"username": "dave", "password": "davepw12345"}, jar2, base=base) == 401