Issue, shape and retire credentials for the private Hermes gateway.

Session cookies are host only, HTTP only and CSRF bound. Nothing here exposes the upstream credential.