Support for Secure & HttpOnly session cookie flags

A little cookie security related patch...

I was not sure whether to make `http_only` enabled by default because I am not aware of any single reason why not. But finally, I decided that it will be safe let CB to behave in the same way as before this commit.

So feel free to change it! :-)