Use `HttpOnly` attribute for `vibe.http.session` by default, see #368

Fix #368