Make session.cookie_httponly line optional, not all hosts permit it...