implement session cookie httponly option
changes
added some tests
Merge pull request #74 from roughy/feature/session_cookie_http_only

Feature/session cookie http only