Configurable HTTPOnly and secure flag for cookie

Added `CSRF_COOKIE_HTTPONLY` and `CSRF_COOKIE_SECURE` configuration
parameters so that it is possible to set CSRF cookie's HTTPOnly and
secure flags on.
Fixed a typo
Merge pull request #37 from jpvanhal/cookie-flags

Configurable HTTPOnly and secure flag for cookie