Cookie settings aren't flexible enough

Assuming that the locale cookie should be stored with the default path and domain is a little bit unwieldy, and prevents localization from working across subdomains, for example.

This pull request allows cookie options to be provided externally, overriding the current setting. The default is to use httpOnly cookies, but this can be overridden as well, which should resolve the issue knarz reported six months ago.