Added AllowNonHttpOnlyCookies as configuration option

To allow for those rare occasions where HttpOnly cookies won't do, I've added a config option to turn the forcing of HttpOnly cookies off.  This option is false (HttpOnly forced) by default.