Set HttpOnly for cookies using :http_only

There's been a few times I've wanted to set HttpOnly on cookies and knowing [RFC 6265 specifies it as HttpOnly](http://tools.ietf.org/html/rfc6265#section-5.2.6) I regularly translate that as `:http_only` in my head due to the capitalization. However, this never works!

To that end I've added the ability to specify `:http_only` but with `:httponly` being preferred if it is specified so it should be non-breaking.