make session cookie http only by default.
Merge branch '4.0'