make session cookie http only by default.
Updated change log.
Merge branch '4.0'