Remove session_is_http_only from sample configs
Change how /rest/whoami works