make session cookie http only by default.
Updated change log.