Use `HttpOnly` attribute for `vibe.http.session` by default, see #368
Merge pull request #373 from ilya-stromberg/master

Use `HttpOnly` attribute for `vibe.http.session` by default, see #368