Add production deployment with sessions

[Andrew-Chen-Wang]

Ref: https://github.com/Andrew-Chen-Wang/SPA-with-httpOnly-sessions

By integrating JWT for dev and sessions for production, you'll have the same great dev times but better production security (when it comes to defending credentials).