Configurable HTTPOnly and secure flag for cookie

Added `CSRF_COOKIE_HTTPONLY` and `CSRF_COOKIE_SECURE` configuration
parameters so that it is possible to set CSRF cookie's HTTPOnly and
secure flags on.